Cyber-criminals are sending out different versions of the email message below with the subject: "Payment confirmation for tax refund request # 75991792." The email messages have a link within them that goes to a malicious Microsoft Word document that will attempt to download viruses, Trojan horses or other malware onto the victims' computers, if they attempt to open them.
The Fake and Virus Email Message
Subject: Payment confirmation for tax refund request # 75991792
Attachment: confimation_75991792.doc
You are receiving this notification because your tax refund request has been processed.
Please find attached a copy of the approved 1040A form you have submitted, containing your personal information and signature.
On the last page, you can also find the wire transfer confirmation from the bank.
Transaction type : Tax Refund
Payment method : Wire transfer
Amount : $7592
Status : Processed
Form : 1040A
Additional information regarding tax refunds can be found on our website:
http://www.irs.gov/Refunds.
Please note that IRS will never ask you to disclose personal or payment information in an email.
Regards,
Internal Revenue Service
Address: 1111 Constitution Avenue, NW
Washington, DC 20224
Website: http://www.irs.gov
Phone: 1-800-829-1040
The link in the message will dowload the following malicious Microsoft Word document onto the victims' computers if they click on it:
The malicious attached Microsoft Word document has a set of instructions called a Macro that will attempt to dowload viruses, Trojan horses and other malware.
The cybercriminals behind the malicious email message aim is to trick the curious recipients into opening the malicious attachment, which will infect their computers with a virus or Trojan horse.
Once their computers have become infected with a Trojan horse or some other malware, the cybercriminals behind this email message will be able to access and take control of their computers remotely from anywhere around the world. They may spy on them, use their computesr to commit cyber-crimes, or steal their personal and financial information.
Now, if you have already opened clicked on the link, downloaded and open the malicious file, please do a full scan of your computer with the antivirus software installed on it.
If you don’t have antivirus software installed on your computer, please click here for a list of free antivirus software.
Click here for a list of email attachments you should never open, regardless of where they came from.
For a list of other virus email messages, please click here.