Researchers at Trend Micro report that a new variant of the Koobface worm is squiggling through Facebook, infecting users and attempting to steal cookies with log-in information for sites such as MySpace.com, MyYearbook.com, Bebo and Hi5 Networks. The Koobface worm first appeared in 2008.
Researchers at Trend Micro are reporting that a new variant of the Koobface worm is spreading on Facebook.
Koobface first appeared in 2008, with separate variants striking members of Facebook and MySpace.com. Now the Koobface worm is back again, with an eye toward stealing cookies for other social networking sites.
According to Trend Micro, the new variant sends Facebook messages claiming to be from a friend. The messages link to a spoofed YouTube video. In an interesting social engineering ploy, the malicious landing page not only displays the friend’s name, but also a picture pulled from the person’s Facebook profile.
The page prompts the user to install a new version of Adobe Flash. Users who agree are redirected to a download site for the file setup.exe, which is the new Koobface variant. Trend Micro detects the worm as WORM_KOOBFACE.AZ, and reported March 1 that its researchers had seen more than 300 unique IP addresses hosting the .exe file.
Source: eWeek
http://tinyurl.com/cetu85