Storm worm shifts path to fake YouTube links

By

The notorious "storm worm" trojan is at it again, this time spreading through a bogus link for a YouTube video, security researchers have warned.

Storm worm shifts path to fake YouTube links
During the weekend, experts began noticing an uptick in spamming of the Nuwar virus that arrives in inboxes as an email claiming to contain a link to a viral video posted on YouTube.

"To the average computer user, the link in the email would seem perfectly legitimate as it points to YouTube.com, but if one were to hover the mouse over the URL, it would point to a numeric IP address," McAfee Avert Labs researcher Vinoo Thomas wrote today on the company’s blog.

The attack uses HTML anchor tags to obfuscate the address, he wrote.

If an unsuspecting end-user clicks on the link, and their computers are updated with the latest patches, the typical storm worm exploit code runs on their PCs, according to a Websense Security Labs alert posted Saturday.

Should users be fully patched, they are routed to a page that requests they run the code manually.

"The malware author has used clever wordings on the webpage in order to entice users to manually download and launch the virus via good old social engineering," Thomas wrote.

Researchers have attributed the recent dramatic rise in spam to the storm worm, which first began appearing in January. The worm attempts to add compromised PCs to its botnet army.

Spammers have customized their tactics to deliver the trojan in different ways, including as electronic greeting cards and news stories.
Got a news tip for our journalists? Share it with us anonymously here.
Tags:

Most Read Articles

Phishing attack nets enormous npm supply chain compromise

Phishing attack nets enormous npm supply chain compromise

Service NSW centralises security, networking in mammoth CloudOps overhaul

Service NSW centralises security, networking in mammoth CloudOps overhaul

VicRoads to phase out passwords in favour of passkeys

VicRoads to phase out passwords in favour of passkeys

Apple adds "mercenary spyware" protection to new A19 chip

Apple adds "mercenary spyware" protection to new A19 chip

Log In

  |  Forgot your password?