Security experts are warning of a phishing scam that targets Red Hat Linux users with a “patch” that is actually a Trojan horse.

The fake message looks like it comes from the “Red Hat Security Team” and warns of a vulnerability in the operating system’s “ls” and “mkdir” commands. It claims “this is a critical-critical update” and that user must take a number of steps to rectify the situation. Those steps including downloading a patch from the fedora-redhat.com domain, which looks like an official Red Hat site but is not.

According to an advisory from K-Otik, a security consultancy in France, the downloaded file creates a user account called “bash” with no password, grabs the infected machine’s IP address and uptime, starts an secure shell daemon and sends the information to a remote address. An attacker can then use the newly created account to access the system remotely.

The e-mail seems to have been sent randomly to general Webmaster addresses for sites and not to any particular mailing list for Red Hat Security issues, according to Tom Liston, a handler with the Internet Storm Center.