Malicious Trojan horse software claiming to provide information on topics like the deadly storms that have battered Europe in recent days infected thousands of computers over the weekend as it spreads rapidly across the globe.
Security vendor Sophos PLC has warned the e-mail tries to entice victims into clicking on the malicious attachments by offering reports on topics like "230 Dead as storm batters Europe," or "U.S. Secretary of Sate Condoleeza Rice has kicked German Chancellor," according to Graham Cluley, the company's senior technology consultant.
The attachments have names such as "Full Story.exe" or "Full Video.exe." Once they are launched, these files install software that then waits to receive further instructions over the Internet, Cluley said. Unlike a worm, this Trojan software does not immediately seek out other targets to infect once it has been installed.
"You think you're reading a news report or you're watching a movie," he said. "It's the age old technique that we've seen since the mid 1990s: Here's something you want to look at. Look here!"
Cluley estimates that the Trojan accounted for about one of every 200 e-mails being sent on the Internet Friday.
These e-mails appear to have been particularly effective because they offer information on a topic that is of intense public interest in Europe right now. Over the past few days storms in northern Europe have caused widespread damage and killed close to 40 people.
Symantec has seen this particular Trojan variant in circulation since last Wednesday, and has counted "thousands" of infections since then.
"It's not a small threat, but it isn't an epidemic either," said Dave Cole, a director with Symantec Security Response.
This latest Trojan -- rated as a "medium" threat by Symantec -- is no more widespread than other similar outbreaks over the past year, but it has raised eyebrows by coming on so quickly.
Some customers were finding that the Trojan was making up as much as 10 per cent of all their incoming e-mail on Thursday, said Adam O'Donnell, a senior research scientist at Cloudmark. "It's not as bad as some other ones," he said. "It just sped up so quickly, it caught some people by surprise."
F-Secure says the Trojan has allowed systems to be taken over by criminal gangs.
Mikko Hypponen, F-Secure's chief research officer, said the attack shows gangs are using every technique available to spread malware, and are able to make use of world events in real time.
F-Secure believes the attack originated in Asia.
"The heavy seeding through spam was quickly obvious on our tracking screens," wrote a spokesperson on the company blog. "The worm was spread throughout the world very rapidly."
- with Matthew Broersma