New Trojan Mimics Windows Reactivation

[Ronald Marva]

Beware of a new Trojan Horse being circulated which impersonate Windows reactivation and anti-piracy messages with the goal of duping users into giving away their credit card information. You know what happens when they get this info!


The new Trojan, dubbed Trojan.Kardphisher, pops up a Windows look-alike screen, which says "Microsoft piracy control," and indicates that another user has activated the copy of Windows and needs to be reactivated. The initial screen even references an actual Microsoft antipiracy site: microsoft.com/piracy. Then, no other applications can be run, and Task Manager cannot be launched to force-quit the Trojan. If reactivation is deferred, the system is shut down.

Should users proceed with the fake reactivation, a second screen appears, requesting private information that includes location, contact information, a credit card number, the card's expiration date and three-digit security number, and even an ATM PIN.

Once you enter your credit card details, the information is sent to the fraud's perpetrators to use as they wish.

So beware of activating this new trojan!