Security firms warn of UPS scam

Posted by Emma Woollacott

Online shoppers are being warned to beware of a phishing scam which exploits this week's shopping frenzy by sending an email purporting to come from UPS.

Victims receive an email warning them that a package couldn't be delivered, and asking them to open an attachment or click on a link - which then infects their machine with malware.

"We’ve seen a number of variants in this campaign (some with attachments, some with no attachments and bad links), all of them personalized to the recipient, and sent from an ever-changing list of fake UPS employees or the generic “UPS Customer Services," says Angela Knox of security firm Cloudmark.

"The from address is faked so that it appears to come from the domain ups.com.  Many of the images are copied from legitimate UPS emails and many of the links go to the legitimate UPS site.   However, clicking on the call-to-action link that says 'Track your shipment now' will take the unsuspecting consumer to a website that can infect the computer with a virus."

Knox says the spammers appear to have been testing their system out, with a relatively quiet weekend followed by a 'huge blast' of spam emails this week.

"With Cyber Monday kicking off the online holiday shopping frenzy, online shoppers should remember to be vigilant about any email message that they receive," says Knox. 

"No matter how eager they are for their shiny new purchases to arrvive, they should take the time to check the original shipping confirmation that comes directly from the online vendor where the purchase was made."

Meanwhile, there are plenty of other spammers out there offering huge discounts on online purchases, some operating via Facebook and twitter, as well as email. One such offered users 'free' iTunes vouchers last week.

"If you receive an unsolicited commercial email don't try, don't buy, don't reply," says Graham Cluley of Sophos.