Don't download Microsoft Security Bulletin MS07-0065!
Malicious spam posing as fake vulnerability patch leads to Trojan horse infection — Experts at Sophos, a world leader in IT security and control, have warned of a widespread attempt to infect email users by sending them a warning about a bogus Microsoft security patch.
Context & Ripple Effects
The bogus-bulletin campaign lands on ground already contested: back in January 2006, experts were publicly advocating non-Microsoft patches for Windows because of dissatisfaction with how updates reached users — an environment where a fake 'MS07-0065' bulletin arriving by email can plausibly pass as routine. Sophos' warning that this spoofed patch spreads a Trojan horse shows attackers have noticed the same thing: the security-update channel itself has become the attack surface.
The story's spread from Sophos to The Register on or about June 28, 2007 reflects a familiar dynamic — the warning about the malware travels further than the malware's actual reach, and each amplification teaches more spammers that Microsoft-branded subject lines get opened.
First-order effects
- Email recipients who download the fake 'patch' are infected with a Trojan horse immediately, giving attackers whatever foothold the payload carries — Sophos' practical advice reduces to: verify bulletins through Microsoft's own site, not email links.
Second-order effects
- Microsoft's legitimate bulletin process takes reputational collateral damage every time a spoof like this circulates, pushing enterprises toward filtering rules and verified-distribution habits that treat even authentic-looking update mail as hostile; antivirus firms like Sophos convert each such wave into detection updates and customer urgency.
Third-order effects
- If impersonation of trusted update channels keeps outperforming direct exploit delivery, the durable fix is architectural — signed, in-product update mechanisms replacing email-delivered advisories — and the industry's trust model shifts from 'recognize the brand' to 'verify the channel.'
The trend: Malware distributors are shifting from attacking unpatched software to impersonating the patch process itself, weaponizing the trust that vendors like Microsoft built around their security bulletins.