Beware "CNN.com Daily Top 10" emails; actually malware

Thousands (possibly millions) of users are receiving what looks like an innocuous daily missive from CNN.com (it sailed right through my spam filter), offering links to the "Daily Top 10" stories and videos. Flag these emails as spam, and do not click the links inside. The links will direct you to a malware website and attempt to install dangerous software on your PC.

In Outlook and many web-based mail clients, the message will show up initially as a series of broken images. If you choose to load the images, you'll see list of 20 randomized stories and videos, most of which look completely harmless ("China tightens security following attack in west"). The use of images bypasses the automatic disabling of web links, so you won't get a security pop-up if you click on one of the links in the email; your web browser will open automatically.

If you do click one of the links you'll get an innocuous-looking CNN-branded video player and an error message with a notice "Video ActiveX Object Error. Your browser cannot play this video file." The message then prompts you to install an ActiveX Object... which, of course, is actually a Trojan horse. You can read more about the specific threat here. (Essentially it opens a door to allow for even more malware to be installed.)

CNN is of course not affiliated with the threat. It doesn't operate the website in question and the messages are being sent from randomized email accounts, likely on infected machines. But keep this in mind if you see any emails from CNN this week, whether or not you subscribe to any of its mailing lists.

More details are available here