Please review my CV - Trojan Horse
Posted By: Thomas Shaw, 10:31pm Tuesday 11 May 2010
Do you virus scan all candidate resumes and other documents before you open them? Chances are YOU may be the perfect candidate these people are looking for.
I have seen a number of these emails this week targeting recruiters. The email sender and contents looks legit and it is a very simple message saying "please review my CV" accompanied by an attachment with the word "resume" in it.
Guess what. When you open the ZIP attachment, you come across another file which looks like it is the candidates resume. But it is actually an executable program (exe) containing a trojan horse called "trojan.sasfis".
The email (and attachment) is not immediately picked up by anti virus software until you extract or run the executable program within the ZIP file.
The virus has been around for a few months and can allow an outside attacker access to personal information or other stored data on the affected computer.
Trojan.Sasfis can compromise the computer that it is installed on allowing a remote attacker to gain access. Trojan.Sasfis should be removed immediately after detection to limit further destruction. You can read a summary and technical details of the threat here.
UPDATE 13/5/2010 Websense Security Labs have confirmed the malware spam "Please review my CV, Thank you!". You can read the full assessment here.
