Pond-dwelling scammers are seeking to exploit interest in last weekend's Brazilian airline disaster (http://www.cnn.com/2006/WORLD/americas/10/02/brazil.crash/) to tempt potential victims onto a site hosting a Trojan downloader.

The malware attempts to install a banking keylogger onto the PCs of potential marks. The attack, written in Portuguese, targets online banking customers in Brazil, a major centre of phishing attacks.

Scam emails contain subject lines such as "fw: as fotos do acidente do boeing da Gol!", as illustrated in an advisory (http://www.websensesecuritylabs.com/alerts/alert.php?AlertID=646) by web security firm Websense.

The ruse attempts to exploit prurient interest in a disaster that killed all 155 people on-board a Boeing 737 jet that crashed into a remote stretch of Brazilian jungle.

Similar - though arguably less sophisticated attacks - followed last year's London bombing attacks, hurricane Katrina, and the Asian tsunami of 2004. No human disaster these days is complete without a topical piece of malware. The language of these malware-promoting scam emails is no longer restricted to English, as the Brazilian Gol Airlines scam shows. ®

Related stories

Pondlife earthquake scammers go mobile (20 May 2008)
http://www.theregister.co.uk/2008/05/20/china_earthquake_scam/
Hackers debut malware loaded USB ruse (25 April 2007)
http://www.theregister.co.uk/2007/04/25/usb_malware/
Scumbag malware authors exploit Virginia Tech tragedy (19 April 2007)
http://www.theregister.co.uk/2007/04/19/virginia_tech_malware_attack/
Inboxes battered by Trojan spam deluge (19 January 2007)
http://www.theregister.co.uk/2007/01/19/trojan_storm/
US harbours one-in-four phishing sites (7 November 2006)
http://www.theregister.co.uk/2006/11/07/phishing_stats_october/
Been in a plane crash? The BBC can help (4 October 2006)
http://www.theregister.co.uk/2006/10/04/plane_crash_advice/
Florida man indicted over Katrina phishing scam (18 August 2006)
http://www.theregister.co.uk/2006/08/18/hurricane_k_phishing_scam/
Katrina web scammer arrested (4 October 2005)
http://www.theregister.co.uk/2005/10/04/katrina_fbi/
Katrina-themed malware attack hits the net (2 September 2005)
http://www.theregister.co.uk/2005/09/02/katrina_trojan_attack/
Phishing attacks soar as viral onslaught wanes (29 July 2005)
http://www.theregister.co.uk/2005/07/29/blackspider_malware_report/
VXers release 'London bombing' Trojan (8 July 2005)
http://www.theregister.co.uk/2005/07/08/london_bombing_spambot/
Fake tsunami appeal website terminated (4 February 2005)
http://www.theregister.co.uk/2005/02/04/fake_dec_site_pulled/
VXers hit new low with tsunami-themed worm (17 January 2005)
http://www.theregister.co.uk/2005/01/17/tsunami_worm/