E-mail Scammers Hiding Malware in Fake IRS Notices

If you get an e-mail telling you that you're under investigation by the U.S. Internal Revenue Service, take a breath before calling your lawyer. It's a scam.

The IRS warned Thursday of two fraudulent schemes that use the IRS's name in an attempt to get victims to install malicious Trojan Horse software on their computers.

In the first scam, the e-mail claims to come from the IRS Criminal Investigation division. It says that the victim is under investigation for filing a false tax return. An attachment to the e-mail, which appears to be the IRS's complaint, actually installs malicious software that gives the criminals access to the victim's PC.

The second scam e-mail says a complaint about the victim's "business services" has been brought against them and advises that this can be arbitrated by the IRS.

The "complaint" attachment included in this scam is actually a new type of Trojan Horse called Backdoor.Robofo, according to security vendor Symantec Corp.

Dispute arbitration is something the IRS doesn't do, according to Michelle Lamishaw, an IRS spokeswoman. "We're in the tax business. We're not in the arbitration business," she said.

In fact, any time you get an unexpected e-mail from the IRS, it's almost certainly fake. "The IRS does not send out unsolicited e-mails," Lamishaw said.

But because these e-mail messages appear to come from the taxman and relate to hot-button topics, some users may click, security researchers warn. "The use of legalese in the message content may intimidate some users into opening the attachment," wrote Symantec researcher Orla Cox, in a entry to the company's Security Response Weblog, posted Thursday.

The IRS became aware of both scams over the past few days, as samples of the e-mail messages were submitted by taxpayers to the phishing@irs.gov e-mail address that is used for reporting scams, Lamishaw said.