Spam News

Anti-virus scareware moves to Twitter

Wednesday, September 23, 2009

Cyber criminals pushing the same scam that corrupted advertising on the New York Times website last week are using Twitter to lure new victims.

Internet security firm F-Secure labs blogged over the weekend that hackers were using dummy Twitter accounts to spread links to malware-infected websites. If the links are clicked, the websites then use intrusive pop-ups and bogus warnings that a user's computer is infested with malicious programs in an attempt to convince them to purchase fake anti-virus software.

Twitter uses CAPTCHA technology - distorted groups of letters and numbers that humans can recognize but text-recognition programs cannot - to foil automated attempts at account creation, but the scam artists have apparently figured out a way to work around this, either by enlisting the help of large groups of assistants or by exploiting some weakness in the CAPTCHA technology itself.

This and the New York Times malvertisers illustrate the changing face of the malware threat. F-Secure security advisor Sean Sullivan told Eweek that "The rogue pages are not very 'malicious' as far as attacking the computer's OS. These are using social engineering tactics and mimicking Windows."