Zbot Pushers Claim Eminem Is Dead

Security researchers warn that cybercriminals are employing fake rumors of Eminem's death to infect users with the Zbot trojan. A fake CBS News mail claiming to link to footage of his car crash is actually directing unsuspecting victims to a malicious website.

Fake news of Eminem, also known as Slim Shady, one of the world's best-selling music artists, dying in a car crash have been circulating around the Internet lately, most likely in a bid to generate traffic. Trend Micro reports that malware pushers have jumped at the occasion and are using the rumor in one of their Zbot distribution email campaigns.

"The email pretends to be from CBS News informing the recipient of the news about Eminem's alleged car crash. It also asks if the user wants to see more information about it. A link is provided in the email to show the user the supposed video. Instead of the video, however, the link redirects to a site that downloads an executable file," Maydalene Salvador, anti-spam research engineer at Trend, warns.

The file is an installer for a new ZeuS variant, detected by Trend Micro products as TROJ_ZBOT.HBI. Zbot, also known as ZeuS, is a family of information stealing computer trojans that have proven particularly effective in stealing online banking credentials. Since ZeuS is sold as a crimeware kit, allowing any of the buyers to customize the malware for themselves, new variants of the trojan and command and control servers pop up on a daily basis.

As strange as it might seem, Eminem is not the first celebrity whose fake death was used to spread malware. In October last year, similar fake rumors of Kanye West dying in a car crash were exploited to distribute scareware via black hat search engine optimization techniques.

Then, in February this year, a BHSEO campaign capitalized on false news that famous actor and comedian Bill Cosby passed away at the age of 72. The poisoned search results on the topic tricked users into downloading rogue antivirus software.

You can follow the editor on Twitter @lconstantin