Malware spreads fake Twitter and Facebook messages
Posted on 14.11.2012
Bookmark and Share
PandaLabs detected a new Twitter spam campaign that may compromise user security. Users receive a direct message on Twitter, which contains the text "Check out Obama punch a guy in the face for calling him a n*****," and a malicious link to a fake Facebook page.


If the user clicks the link, they are taken to a bogus Facebook page where they are prompted to submit their Twitter log-in details. However, if the user enters their credentials, the malware will hijack their account in order to send the same malicious message to all of their contacts.

The user is then taken to a website that displays a fake YouTube video set against a fake Facebook background. This time, the victim is asked to update a 'YouTube player' to watch the video. As typical with this type of scam, if the user clicks on the 'Install' button, the Koobface.LP worm is downloaded, infecting their computers and attempting to steal all their personal data.

"This attack exploits the two most popular social networking sites, Facebook and Twitter, to trick users into believing they are viewing a trusted site," said Luis Corrons, technical director of PandaLabs. "It also relies on its victims' curiosity by using a scandalous story involving U.S. President Obama and racism. Cyber-criminals know people are curious by nature and take advantage of this to trick users and infect them with their creations."

This is just the latest example of a cyber-scam that uses Twitter direct messages to spread. Users' accounts receive dozens of them every day with malicious links and enticing messages such as, "What exactly do you think you're doing on this video clip", "Hello this guy is saying bad rumors about u...," and "Did you see this pic of you?", etc.

"Never, ever, click the links within the text of those messages as they could infect your computer," explained Corrons. "Every time you receive a direct message you should check with the sender that they have knowingly sent it to you. Make sure it has not been automatically forwarded to you from a hacked account. As a general rule, always keep your antivirus software up to date and be wary of messages offering sensational videos or unusual stories as, in 99 percent of cases they are designed to compromise user security."





Spotlight

Attackers use reflection techniques for larger DDoS attacks

Posted on 17 April 2014.  |  Instead of using a network of zombie computers, newer DDoS toolkits abuse Internet protocols that are available on open or vulnerable servers and devices. This approach can lead to the Internet becoming a ready-to-use botnet for malicious actors.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Fri, Apr 18th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //