New malicious MySpace spam poses as friend

Stan Beer
Sunday, 20 January 2008 04:58

Your IT - Home IT

A new malware-toting spam email posing as an invitation from a friend to join to MySpace can turn the computer of a recipient who takes the bait into a botnet zombie spewing out spam and phishing emails.

According to Internet security specialist Marshal, the message contains a link which when clicked transfers the user to a fake, but authentic looking MySpace website. The user is then told they need to update their Adobe Flash Player to use the site properly and should download the latest version.

The download is, in reality, malware which installs more components from the Web to convert the now infected computer into part of a spam botnet. Within minutes the new zombie computer begins sending duplicate messages of the bogus MySpace invitation interspersed with phishing emails targeting a major US bank.

“We saw sites such as YouTube targeted in these kinds of malware distribution campaigns last year. It follows that social networking sites would be next on the spammers list of targets to exploit, although this newest campaign arrived a little sooner that expected. This attempt to exploit MySpace is simplistic but effective,” said Bradley Anstis, Marshal’s VP of Products.

“Marshal’s TRACE Team last year predicted that social networking sites such as MySpace would be increasingly used as vehicles for spreading malware in 2008..Their popularity and rapid growth with Internet savvy users makes them an ideal vehicle for this kind of activity. People’s guards are lower and they are more accepting of familiar looking messages coming from seemingly trusted and frequently used websites.

“People post a lot of personal information on these kinds of sites and spammers will start to exploit some of that information in more sophisticated targeted campaigns during 2008. Expect to see more of these kinds of emails, maybe even offering a link to your favourite band’s latest music video. The spammers will be able to easily gather this kind of information about you from social networking sites that you participate in,” said Anstis.   

More information on the MySpace malicious spam can be found here.