Sophos: Catchy email subject headings unleash worms

Anti-virus vendor Sophos are warning users about a new email worm that exploits interest in the World Cup to attack computers.

The W32/Sixem-is a worm that spreads using a variety of disguises, including subject lines such as "Naked World Cup game set", "Soccer fans killed five teens", and "Crazy soccer fans".

According to Sophos, these subject headings include sentences like, “Nudists are organising their own tribute to the world cup, by staging their own nude soccer game, though it is not clear how the teams will tell each other apart. Good photos ;)”.

Other messages include, “Soccer fans killed five teens, watch what they make on photos. Please report on this all who know”.

If the attached file is run, it attempts to disable security software on the infected computer and then spread itself to other email addresses.

Sophos experts report that this is not the first time that hackers have taken advantage of the World Cup competition.

In May 2006, the W32/Zasran-D worm offered tickets to the World Cup to German computer users. In the same month, a Trojan horse was spammed out posing as a wallchart for the soccer tournament.

A year ago, the Sober-N worm offered tickets to the tournament in an attempt to entrap unprotected users.

In 2002, the VBS/Chick-F virus tried to exploit workers desperate to find out the latest scores from the World Cup in South Korea and Japan.

In 1998, in the run-up to the World cup competition in France, another football-inspired virus asked infected victims to gamble on who the winner might be, and if the user did not choose the right team triggered a warhead which was capable of wiping all the data off the hard drive.

cup wormsecuritysophos world