Western Union Scam Attack

Got money waiting? No you don't, that's malware, not cash.

You used to be able to rely on Western Union just for sending money. Now, however, if you receive a notification that there’s a money transfer you haven’t collected, there’s a very good chance it’s malware, according to security company Sophos, which has picked up a crop of spam mails supposedly originating from Western Union.

The mail purports to inform you of a money transfer that you’ve never collected, which will, of course, be news to you. All you need to do to get the cash is print the enclosed form and take it to the nearest office:

“According to the Western Union regulation which are not collected in 15 days are to be returned to sender. To collect cash you need to print the invoice attached to this email and visit the nearest Western Union branch.”

And that’s where the problem begins. Opening the form performs a PDF vulnerability exploit, and installs a Trojan app that then infects with more malware.

Of course, it’s targeting the greedy and curious, like most scams, and Sophos’s Graham Cluley warned:

"If you haven’t sent any money via Western Union, then why would they be telling you it failed to be delivered properly?"
"Common sense is your friend. It’s just such a shame that it doesn’t seem to be very common."