Sophos has posted a blog entry about an e-ticket notification.

The notice tells the user that their account has been created. It lists their login info which includes their login name and and their password. It also tells them how much has been charged.

A Youtube video is embedded on the blog entry which shows more information about this spam.

The email contain an attachment called eTicket#XXXX.zip. It is detected by Sophos as Troj/Zbot-AE. A user’s internet bill will soar when he or she launches the attached program. The attachment is supposed to be the purchase invoice and the flight ticket of the user.

Source: Sophos