XPost: comp.sys.mac.misc   
   From: Some@Guy.com   
      
   Warren Oates wrote:   
      
   > This is all standard Nigerian garbage, except that they provide a   
   > tracking number for Fedex,   
      
   I see that nigerian stuff all the time.   
      
   What I find interesting over the past couple of weeks is a persistent   
   campaign where the spam claims to be either an American Airlines ticket   
   link or reciept link, or a DHL tracking link.   
      
   The link is to a .zip file that unzips to a single .exe file that is   
   only ID'd by a small fraction (5 to 12) out of 46 AV programs at   
   VirusTotal.  The sample is ID'd as either specifically as Dofoil or   
   Kuluoz but more generally as "generic" or "suspicious".   
      
   I've seen campaigns like this in the past, but I don't recall them   
   lasting for this many days.   
      
   --- SoupGate-Win32 v1.05   
    * Origin: you cannot sedate... all the things you hate (1:229/2)