The email, which purports to route to an update of the browser – which has been downloaded by several tens of millions of PC users worldwide since the last update on January 21 – actually routes to an adware-infested site.
According to Firefox user forum reports, the 'update site' is a very clever forgery that can fool even the most experienced Windows users.
Mozilla is recommending that users of Firefox do not respond to update emails directly and instead go to the main update page routed in the help menu dropdown on their browser, and update from there.
The fake email can also be spotted by the fact that the landing page advertises Firefox v3.5, when the latest version is actually v3.6, and there are mis-spellings – such as the words `anti-pishing' in the header of the message.
The adware-infested landing page routes to a Hotbar download from Pinball Corporation, previously known as Zango, which, whilst ostensibly allowing users access to direct links to a variety of useful pages, also reportedly bombards them with pop-up ads.
The reasoning behind the fake Firefox 'update' emails is that pay-per-install affiliate schemes can pay as much as a dollar per install for adware-driven apps such as Hotbar, which in turn generate revenue from pay-per-click advertisers.