English
The Internet threat alert status is currently normal. At present, no major epidemics or other serious incidents have been recorded by Kaspersky Lab’s monitoring service. Internet threat level: 1

Koobface on the tweet

Marco
Kaspersky Lab Expert
Posted July 14, 16:32  GMT
Tags: Social Networks, Koobface
0
 

We are currently witnessing a new wave of Koobface messages flooding twitter. The message that is mostly used right now is: "My home video :) <URL>"

The link in infected tweets points to a site with a little javascript.

The script calls a php-script on a server which uses an ID to return an IP address leading to the video site. This means the IP address is different for every request.

Interestingly, the guys behind this attack are clearly out to maximize their ROI: if you're using Mac or Linux, you end up getting redirected to an adult site.

Twitter is saying it may block infected accounts. We're doing our part as well - our users are already protected from the malicious file:

And we've also added protection against the malicious tweet itself, which will be detected as Net-Worm.Win32.Koobface.aqy as updates are rolled out to our users.


Comments

If you would like to comment on this article you must first
login


Bookmark and Share
Share

Analysis

Blog