Spam targets online tax payment services

About this threat:

A new phishing target has emerged this past week: The Electronic Federal Tax Payment System (EFTPS), a free service offered by the US Department of the Treasury to help people and businesses make their tax payments online.


The spam messages claim that a recent payment has been rejected with a &quote;return code" of R21. It then provides a link so that the recipient can look up information about this particular situation. While the label around the link suggests that it leads to an explanation of what this return code means, the actual destination is an unrelated domain that changes quite often. When clicked, these links redirect the user to a variety of Russian domains.

Here is a typical message:

more @ http://www.sophos.com/security/threat-spotlight/index.html#threat2