Sponsored By

Trojan Attack Masquerades As Airline E-Ticket NoticeTrojan Attack Masquerades As Airline E-Ticket Notice

Realistic-looking email messages from Northwest, United actually bear data-stealing malware, researcher warns

Security researchers have spotted a new attack designed to fool users into thinking that airline tickets have been purchased with their credit cards.

The attack, which was first spotted as an email from Northwest Airlines, and subsequently as a message from United Airlines, is a realistic-looking "receipt" that contains an attachment bearing the name Your_ETicket.zip or eTicket.zip, according to researchers at security vendor Sophos.

The idea is to fool the unwitting user into clicking on the attachment to get more information on who purchased it, according to Graham Cluley, a researcher at Sophos. "The file doesn't contain a genuine electronic ticket, of course, and your credit card has not been charged," he says. "The hackers are hoping that you will be so affronted at being charged for an airline flight that you haven't booked that you will open the attachment without thinking."

Users who click on the e-ticket file trigger the download of Troj/Agent-IPS, a data-stealing Trojan horse.

The airline ticket disguise isn't new, Cluley notes. A similar scam was detected early last month, and a broader scam took place in the middle of last year. Cluley warns users who receive the messages to keep their cool.

"Although it's understandable that you might panic into thinking that your credit card has been debited without your permission for a flight you don't want or need, you should be cynical enough to smell this for what it is -- a dirty, rotten scam designed to infect your personal computer," Cluley says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message

About the Author(s)

Tim Wilson, Editor in Chief, Dark Reading


Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one of the top cyber security journalists in the US in voting among his peers, conducted by the SANS Institute. In 2011 he was named one of the 50 Most Powerful Voices in Security by SYS-CON Media.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like

More Insights