Pagoda Blog

Malicious actors are exploiting the April 15 explosions at the Boston
Marathon in attempts to collect money intended for charities and to
spread malicious code. Fake websites and social networking accounts have
been set up to take advantage of those interested in learning more
details about the explosions or looking to contribute to fundraising
efforts.

For example, the Twitter account @_BostonMarathon was created shortly
after the explosions took place. The account stated it would donate $1
for each retweet and was crafted to closely resemble the legitimate
Boston Marathon Twitter account (@BostonMarathon). This account has
since been suspended by Twitter; however, the likelihood that similar
social media accounts will surface remains high.

Phishing email campaigns are also circulating using subject lines
related to the Boston Marathon explosions. Do not open unexpected
attachments or click on links in suspicious emails, even if the email
appears to be from someone you know.

This document can also be found at
http://www.us-cert.gov/ncas/current-activity/2013/04/17/Scams-Exploiting-Boston-Marathon-Explosion