Buy McDondald’s Hamburgers, Not Spam

Cyber criminals are capitalizing on McDonald’s trusted family friendly global reputation. With the holiday season in full swing, it is easy for people to let their guard down. People are receiving emails with dangerous worms disguised as coupons and another email with a fake McDonald’s survey.

Fake McDonald’s Malware Email
Recently it was detected that there is increased activity related to fake email messages being presented with Christmas coupon offers from the McDonald’s restaurant chain.  The email message informs the reader to the existence of an updated McDonald’s discount menu.  The e-mail message attempts to convince users to open a .zip attachment to receive coupons that are redeemable at their local McDonald’s franchise.  The attachment contains a malicious .exe file.  If executed, the .exe file infects the targeted user’s system with malicious code.

E-mail messages that are related to this threat may contain the following files:
coupon.zip
coupon.htm or spaces.exe

The .exe file in the .zip attachment has a file size of 449,024 bytes.  This threat outbreak is related to the W32.Ackantta@mm worm and has a severity rating of 4.  The worm could allow a remote attacker to execute arbitrary commands on the infected computer system or gather information such as IP addresses or user keystrokes.

The following text is a sample of one of the email messages that is associated with this threat outbreak:
Subject Line: McDonalds wishes you Merry Christmas!
Message Body: McDonald’s is proud to present our latest discount menu.  Simply print the coupon from this Email and head to your local McDonald’s for FREE giveaways and AWESOME savings.

Fake McDonalds Phishing Email
In a related story by John Leyden, phishing criminals are attempting to scam people into handing over their personal details on the basis of a supposed offer from McDonalds.  The scam relies on spam emails to trick readers into answering a fictitious satisfaction survey that offer a non-existent reward of $75.00. After completing the survey prospective marks are asked to hand over their banking details in order to receive their reward. Unsuspecting people are asked for their name, email address, and credit card details.