Malicious 'terror attack' spam sets off security alarms

According to researchers from several security firms, including McAfee and Sophos, the attacks are being sent out as spam messages which contain hyperlinks.

The attacks carry such headlines as "why did it happen in your city?" and " at least 18 killed in your city."

The message itself contains little more than a short sentence and a link to a phony news site.

Where the attack distinguishes itself, however, is the use of geolocation services which collect traffic data and then insert the name of the user's city of origin into the article, further increasing the chances that a user will click on what appears to be a video file on the page.

Rather than load a video, however, the page attempts to download an executable file on the target system. That file then infects the user with malware from the 'Waledac' botnet (also known as 'waled.')

"They are using the city name of the user visiting the fake website and inserting this name into the website itself," explained McAfee researcher Micha Pekrul.

"So the 'breaking news' gets even more attention, because when an attack happens in your home town, everyone would be anxious and curious."

Neither tactic is particularly new. Malware writers have in recent years taken to creating fake news pages for news events, attacks and natural disasters, both real and fabricated, to spread their wares. Geolocating is also becoming a particularly effective tool for use in social engineering attacks.

Copyright ©v3.co.uk

attackattackscityfileitselfmalwaresecurity