Earlier this evening I intercepted a single instance of a new Trojan malware ploy, which may be of interest.
Unlike most of these scams, this one was written in good English and sounded very plausible. It was sent directly to a mail host and was pretending to come from the administrator of that host, stating that the mail server was going to be upgraded on a specific date in the near future and the SSI(sic) certificate was going to change. It instructed the recipient to download an update for the (supposed) Windows PC you were using, and this would install he new certificate. It used a mangled URL that looked like it came from the mail hosting provider.
These people are using ‘clean’ IP addresses to send from so they won’t appear in lists of known spammers. The URL for the download (1ssl-cert.net) was freshly registered, and this was the only thing about it that an automated spam detector would have noticed.
A lot of people may be fooled by this. Watch this space.