The UK's National Hi-Tech Crime Unit (NHTCU) said the spam e-mails contain details of a fictitious order for Web hosting or computer goods and display the cost that will supposedly be charged to their credit card.
The e-mail also contains a link to a Web site to view the order in more detail but if people click on the link, it takes them to a malicious Web site that allows hackers to steal data from their PC.
The user is presented with a site that appears to be under construction but an exploit for a security flaw in Microsoft's Internet Explorer browser allows the criminals to plant a key-logging Trojan on an unpatched PC. The hackers can then record the victim's log-ins, passwords and PINs for online banking accounts the next time they use them.
In addition, the Trojan compromises the machine, giving the attacker full remote access, which allows them to control the computer for other purposes.
Police have traced the malicious Web sites to North America and China and the NHTCU is working with the banking industry to shut them down.
Users are urged to download the latest Microsoft security patches for the well-publicised flaws in IE to protect themselves against the scam.
Detective Chief Superintendent Len Hynds, Head of the NHTCU said in a statement: "The criminals behind these attacks are constantly evolving their techniques and changing tactics to target a wider range of victims. With this range of exploits being blended in one piece of code, it is not just about online banking. There is a second key-logger and a program that allows the machine to act as a mail proxy that could be used by spammers. It is the Swiss Army knife of the cybercriminal."
