|  |
Koobface Now Using Christmas Theme
Websense Security Labs ThreatSeeker Network has discovered that the Koobface malware campaign is now using a Christmas theme. Recent developments by Koobface have included use of Google Reader.
The Koobface Web site offers a video posted by 'SantA'. The usual ruse of requiring a codec to watch the video is used, to encourage the user to install and run a file called setup.exe (SHA1:a2046fc88ab82abec89e150b915ab4b332af924a). This file is currently detected by 16 out of 41 www.virustotal.com/analisis/59d6f355cfeba6684dd03954e84615c
bb79def11e40b1f69cd4275645b8e48af-1259587988 antivirus products according to VirusTotal.
On the compromised Facebook page the user is presented with a link to ch[removed]cher.ch which is a compromised site in Switzerland. The user is redirected to one of several Koobface Web sites through a malicious Flash movie file hosted on the compromised site. If the user runs the infected file, the worm will automatically login to their Facebook, Myspace, and several other social networking sites and send messages to all their friends.
Websense Messaging and Websense Web Security customers are protected against this attack.
To view the details of this alert Click here http://securitylabs.websense.com/content/Alerts/3505.aspx 02.12.2009, Rebecca Zarkos, Websense UK
Subscribe to the newsletter | | |
| | | |
