Early this morning our Threat Operations Center noticed a new spam campaign originating from the Cutwail botnet spoofing the IRS that is attempting to lure users into clicking on a link which directs them to a web site to download malware.  Over the past 3 hours we have been watching approximately 90,000 of these messages hitting our systems per hour.

The email attempts to trick the user into believing that they misreported their income and gives them a link where they can review their tax statement online.




The link in the email does not directly install malware on the user's machine.  Instead, potential victims are directed to a web site where they can download an executable file named tax_statement.exe, which contains the malicious code.