Curiosity-piquing Twitter DM leads to double threat
Posted on 15.11.2012
A double threat has been aimed at Twitter users as Direct Messages carrying a Facebook link and the question "what on earth could you be doing in our movie?" are currently doing rounds.

The unfortunate users who can't suppress their curiosity and follow the link are taken to a Facebook App page that tells them that they can't view the video in question unless they are logged into Twitter:

Unfortunately, the offered login page is not Twitter's, and the submitted login credentials end up on the scammers' servers and will be used for mischief at a later date.

But that's not all.

Once the victims have "logged in," they are faced with another obstacle to watching the video: they need to update their "Youtube Player."

"Users may get an impression that theyíre still within the App page; however, the Facebook elements of this page are all fake," GFI researchers point out. "Clicking Install downloads a file named FlasshPlayerV11.1.37.18.exe."

The file in question is a Trojan variant that is currently detected only by half of the AV solutions used by VirusTotal, and its main goal is to drop and execute another malicious file named javas.exe.

GFI researchers say that their findings suggest that itís a stand-alone malware that simply performs its tasks on an affected system once it executes, and that it does not establish any form of communication over the Internet nor does it steal information.

On the other hand, these particular files are not unknown, and Webroot says that javas.exe variants are known to sometime be cloaked banking information stealers that are also capable - among other things - of reading email address and phone book details, as well as open browser pop ups.

In the end, it doesn't really matter what it really does - the important thing to know is that it's altogether bad news. And it's also good to know that this same exact approach - but with a different lure - has been spotted just yesterday.

As PandaLabs' Luis Corrons warned at the time, be wary of messages offering sensational videos or unusual stories as, in 99 percent of cases, they are designed to compromise user security.


Harnessing artificial intelligence to build an army of virtual analysts

PatternEx, a startup that gathered a team of AI researcher from MIT CSAIL as well as security and distributed systems experts, is poised to shake up things in the user and entity behavior analytics market.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Thu, Feb 4th