Phishers are stealing personal data through a spam campaign that targets victims with fake invoices, according the security company Symantec.
A malicious PDF file attached to the offending email downloads an executable file called "Google update service", allowing hackers to scoop information entered into a web browser.
Bhaskar Krishna, an employee at Symantec, said: "While these invoices may appear to be legitimate because the sender’s email address may be associated with a major company, the emails contain spelling errors in the subject line and the body of the email contains just one line of text.
"Most business emails contain a personal greeting to the recipient and the sender’s signature, but these emails have neither. These signs should serve as warnings to users that the email is not what it claims to be."
He added that the exploit takes advantage of a vulnerability associated with Adobe Acrobat and Reader, which were recently found to be being exploited by Dyreza banking malware, according to security firm Trend Micro.
While these emails were poorly written, other hackers have created professional looking spam campaigns, even spoofing email addresses so that the messages appear to come from an company’s official domain name.
