For the past week, cyber criminals have been targeting Twitter users by creating thousands of messages (tweets) embedded with words involving trending topics and malicious URLs. If the URLs were accessed, the victims would arrive at a rogueware website designed to trick them into thinking that their computer is infected, therefore justifying the need to purchase the fake software offered. Since the initial discovery, we have been keeping a close eye on this attack, but the malicious tweets continue. From June 2nd – 3rd we noticed over 3,000 of these malicious tweets (actually, the number is a lot higher than 3k because we only tracked the main abuse site and excluded the shortened URL’s from the initial search). On June 6th the main site was taken offline and the attack shifted from Adware/PrivacyCenter to the Adware/FastScan. Current targeted phrases: WordPress 2, Fallon, Top Chef, Tila Tequila Live, AT&T, Limp Bizkit, Sytycd, iPhone, Adam Lambert, Wipeout, Holocaust Museum, Miss California, Claim your Facebook, Squarespace, Lakers, NBA Finals, Zack Morris, addict, video, trailer. Current Scareware site: File: Setup_build6_27.exe (MD5: efe9ddbea8bd71fdfee44d44811e4695 ) Installer: Adware/FastAntivirus At the moment, we have identified over 20 accounts and 1200+ tweets still targeting the trending topics on Twitter. The criminals are using various URL shortening services and the Twitter staff is making an effort to suspend the accounts, but as soon as they do, another account is created by the cyber criminals. Here is what that data looks like visualized. Update: As of 1:00 AM 6/11/09 we have identified an additional 21active accounts spreading malicious links. ( new accounts not included in the visualization below) Blue = Twitter Account Purple = Malicious URL Red = Tweet Zoom in: The ease of carrying out this type of attack leaves us to believe that this will not go away anytime soon. We’re all going to have to work together in taking these threats down and the good news, in this case, is that I have already received a response from the abuse team at TinyURL and they have responded by killing the redirections on their end. Now all we need is for everyone else to start working together and we’ll be able to help take these dangerous accounts down sooner!
source
Tags:
adware,
antivirus,
panda
Posted under Malware Alerts