Sophos has posted a blog entry on their website that Customs-based messages are being sent out by the same people who sent UPS spam.

The author of the article included a paragraph from the spam. It says, “We have received a parcel for you, sent from France on July 9. Please fill out the customs declaration attached to this message and send it to us by mail or fax. The address and the fax number are at the bottom of the declaration form.”

There is a zip file attachment and it is a Trojan. It is detected as Mal/Spy-A according to the blog entry.

Source: Sophos