Sponsored by..

Friday, 27 April 2012

CareerBuilder spam / popcows.net

These fake CareerBuilder messages attempt to download malware from popcows.net via a legitimate hacked site.

Date:      Fri, 27 Apr 2012 10:58:00 -0300
From:      Risa@site.careerbuilder.com
Subject:      You might be interested in this vacant position.


Hello,

I am a customer service representative at CareerBuilder. I found a vacant position at Security Finance Corporation that you may be interested in based on information from your resume or a recent online application you made on our site. You can review the position on the CareerBuilder site here:

Chief Business Development Officer


We wish you best of luck!


Risa
Careerbuilder Customer Service Team
CareerBuilder ,5550-A Peachtree Parkway , Norcross, GA 30092

You are currently subscribed to receive "CareerBuilder.com Customer Messages" as service@careerbuilder.com
You can modify your account info or unsubscribe from this email at any time.

==========

Date:      Fri, 27 Apr 2012 18:52:37 +0530
From:      Deena@site.careerbuilder.com
Subject:      You might be interested in this vacant position.


Hello,

I am a customer service officer at CareerBuilder. I found a position at Security Finance Corporation that you may take interest in based on information from your resume or a recent online submission you made on our site. You can review the position on the CareerBuilder site here:

Customer Service Representative


We wish you best of luck!


Deena
Careerbuilder Customer Service Team
CareerBuilder ,5550-A Peachtree Parkway , Norcross, GA 30092

You are currently subscribed to receive "CareerBuilder.com Customer Messages" as service@careerbuilder.com
You can modify your account info or unsubscribe from this email at any time.

The link tries to download from popcows.net/main.php?page=d024eabc8c2bdbfc (70.32.97.205 / Media Temple, US) which is 404ing at the moment, however it is still worth blocking it as a precaution.

No comments: