The worm is aimed at users of Paypal, a popular method of internet payment among online shoppers. Infected emails carry the subject line "YOUR PAYPAL.COM ACCOUNT EXPIRES" and pose as a security update. The email threatens to close the recipient's account if they do not obey the update instructions it gives.
Cleverly, the email warns readers not to send their details back by return email. Many users now know this is insecure and that companies never request this.
Instead, the email asks them to click on an executable file called paypal.com.scr. This brings up a dialogue box, complete with PayPal logo, requesting their credit card number, PIN, expiry date and security code. Any details entered are then sent to the virus writer.
"It is a pretty sneaky and professional trick. They have gone to some effort to make it looks as plausible as possible," says Graham Cluley of Sophos, the UK-based anti virus company that first reported W32/Mimail.I at 0500 GMT on Friday. The virus has been seen in the UK, South Africa, Australia and New Zealand and is spreading.