More on the BBB and IRS phishes

Analyst Joe Stewart informs me that these are being sent by at least two different groups, using two different approaches. His analysis of the BBB phish describes the phish in detail. In short, the trojan connects to Internet Explorer and steals everything it can get ahold of. Over 145 Mb of data has been collected from over 1400 victims so far.