Devoted to hardware, software, IT issues, and information technology management

Sophos warns about a spammed email campaign that claims to be security advice from Microsoft, but actually tries to encourage users to install a keylogger onto their computers.

The spammed emails, which claim to come from patch@microsoft.com, claim that a vulnerability has been found "in the Microsoft WinLogon Service" and could "allow a hacker to gain access to an unpatched computer".

Recipients are advised to click on a link in the email to download the patch. However, the link really points to a non-Microsoft Web site and begins the download of the Troj/BeastPWS-C Trojan horse, which is capable of spying on the infected user and stealing passwords. When first installed the Trojan horse displays the following bogus message: Microsoft WinLogon Service successfully patched., but is secretly logging keystrokes and sending them to an email address belonging to the hacker.

source