Sponsored by..

Friday, 5 October 2012

"Intuit GoPayment" spam / simplerkwiks.net

This fake "Intuit GoPayment" spam leads to malware on simplerkwiks.net:

Date:      Fri, 5 Oct 2012 15:54:26 +0100
From:      "Intuit GoPayment" [abstractestknos65@pacunion.com]
Subject:      Welcome - you're been granted access for Intuit GoPayment Merchant

Greetings & Congrats!
Your GoPayment? statement for WALLET , DEVELOPMENTS has been issued.
Intuit Payment
Account No.:     XXXXXXXXXXXXXX16
Email Address:     [redacted]
    Additional charges for this service may now apply.
Next step: Confirm your User ID

This is Very Important lets you:
Manage your payment service in the Merchant Center
Review charges
Log In to other Intuit products you may use, like TurboTax, Quicken, and Intuit Payroll

The good news is you have active an existing Intuit account for your email address, You can use this ID for your payment service also, or enter a new one.

Verify UserID
Get started:

Step 1: If you have not still, download the Intuit application.

Step 2: Run the GoPayment app and sign in with the UserID (your email address) and Password you setup.

Easy Manage Your GoPayment System

The Intuit GoPayment Merchant Service Center is the website where you can learn a lot about GoPayment features, customize your sales receipt and add GoPayment users. You can also manage transactions, deposits and fees. Visit link and signin with your GoPayment Access ID (your email address) and Password.
For more information on how to get started using Intuit Merchant, including tutorials, FAQs and other resources, visit the Service Center at web site.
Please do not reply to this message. automative notification system not configured to accept incoming email.
System Terms & Agreements     � 2012 Intuit, Inc. All rights reserved.

The malicious payload is at [donotclick]simplerkwiks.net/detects/congrats_verify-access.php hosted on (Vodafone, Fiji) along with these other suspect domains:

No comments: