Spamhaus forged (again) in malware phish attack

Spamhaus warns of a rise in forged emails impersonating Spamhaus that attempt to phish recipients into installing malware. The advisory clarifies that genuine Spamhaus notifications are sent only to bona fide POC addresses, automated messages never include attachments or executables and are plain text, lookups are performed via normal HTTP, and provides the legitimate SPF range for spamhaus.org; it also notes related spear-phishing targeting ESPs and reputation firms (e.g., ReturnPath) and that law enforcement is involved in the investigation.