CareerBuilder spam / popcows.net

These fake CareerBuilder messages attempt to download malware from popcows.net via a legitimate hacked site.

Date:      Fri, 27 Apr 2012 10:58:00 -0300
From:      Risa@site.careerbuilder.com
Subject:      You might be interested in this vacant position.


Hello,

I am a customer service representative at CareerBuilder. I found a vacant position at Security Finance Corporation that you may be interested in based on information from your resume or a recent online application you made on our site. You can review the position on the CareerBuilder site here:

Chief Business Development Officer


We wish you best of luck!


Risa
Careerbuilder Customer Service Team
CareerBuilder ,5550-A Peachtree Parkway , Norcross, GA 30092

You are currently subscribed to receive "CareerBuilder.com Customer Messages" as service@careerbuilder.com
You can modify your account info or unsubscribe from this email at any time.

==========

Date:      Fri, 27 Apr 2012 18:52:37 +0530
From:      Deena@site.careerbuilder.com
Subject:      You might be interested in this vacant position.


Hello,

I am a customer service officer at CareerBuilder. I found a position at Security Finance Corporation that you may take interest in based on information from your resume or a recent online submission you made on our site. You can review the position on the CareerBuilder site here:

Customer Service Representative


We wish you best of luck!


Deena
Careerbuilder Customer Service Team
CareerBuilder ,5550-A Peachtree Parkway , Norcross, GA 30092

You are currently subscribed to receive "CareerBuilder.com Customer Messages" as service@careerbuilder.com
You can modify your account info or unsubscribe from this email at any time.

The link tries to download from popcows.net/main.php?page=d024eabc8c2bdbfc (70.32.97.205 / Media Temple, US) which is 404ing at the moment, however it is still worth blocking it as a precaution.

CareerBuilder spam / masterisland.net

Some fake CareerBuilder emails leading to malware on masterisland.net:

Date:      Thu, 26 Apr 2012 10:40:58 -0430
From:      Vielka@site.careerbuilder.com
Subject:      Careerbuilder.com has found a vacant position for you


Hello,

I am a customer service officer at CareerBuilder. I found an open position at Security Finance Corporation that you may take interest in based on details from your resume or a recent online submission you made on our site. You can review the position on the CareerBuilder site here:

Chief Business Officer


Best wishes in your job search!


Vielka
Careerbuilder Customer Service Team
CareerBuilder ,5550-A Peachtree Parkway , Norcross, GA 30092

You are currently subscribed to receive "CareerBuilder.com Customer Messages" as service@careerbuilder.com
You can modify your account info or unsubscribe from this email at any time.

=======================

Date:      Thu, 26 Apr 2012 17:10:21 +0200
From:      Gretchen@site.careerbuilder.com
Subject:      Careerbuilder.com has found a vacant position for you


Hello,

I am a customer service representative at CareerBuilder. I found a position at Security Finance Corporation that you may find attactive based on information from your resume or a recent application you made on our site. You can review the position on the CareerBuilder site here:

Chief Human Resources Officer


We wish you best of luck!


Gretchen
Careerbuilder Customer Service Team
CareerBuilder ,5550-A Peachtree Parkway , Norcross, GA 30092

You are currently subscribed to receive "CareerBuilder.com Customer Messages" as service@careerbuilder.com
You can modify your account info or unsubscribe from this email at any time.

=======================

Date:      Thu, 26 Apr 2012 17:15:13 +0200
From:      Vielka@site.careerbuilder.com
Subject:      You might be interested in this vacant position.


Hello,

I am a customer service officer at CareerBuilder. I found an open position at Security Finance Corporation that you may take interest in based on information from your resume or a recent application you made on our site. You can review the position on the CareerBuilder site here:

Chief administrative officer


Best wishes in your job search!


Vielka
Careerbuilder Customer Service Team
CareerBuilder ,5550-A Peachtree Parkway , Norcross, GA 30092

You are currently subscribed to receive "CareerBuilder.com Customer Messages" as service@careerbuilder.com
You can modify your account info or unsubscribe from this email at any time.

=======================

Date:      Thu, 26 Apr 2012 21:09:52 +0530
From:      Karen@site.careerbuilder.com
Subject:      You might be interested in this position.


Hello,

I am a customer service employee at CareerBuilder. I found a position at Security Finance Corporation that you may be interested in based on details from your resume or a recent online application you made on our site. You can review the position on the CareerBuilder site here:

Chief Financial Officer


Best of luck to you in your job search!


Karen
Careerbuilder Customer Service Team
CareerBuilder ,5550-A Peachtree Parkway , Norcross, GA 30092

You are currently subscribed to receive "CareerBuilder.com Customer Messages" as service@careerbuilder.com
You can modify your account info or unsubscribe from this email at any time.

The link in the email goes through a legitimate hacked site to a payload on masterisland.net/main.php?page=975982764ed58ec3 (report here) hosted on 70.32.97.205 (Media Temple, US). There seem to be a lot of these spams coming out right now, so this is worth blocking.