Samples intercepted by SophosLabs reveal that the unsolicited instant messages urge users to "check out this video" by clicking on a link via the TinyURL service. The link, however, directs users to a website called ViddyHo - which asks surfers to enter their Gmail usernames and passwords.
TinyURL has now blacklisted the site, meaning that the current link structure will no longer work.
Reading our newsletter every Monday will keep you up-to-date with security news.
Receive a daily digest of the latest security news.