Viruses/Worms News

Twitter suspends accounts of users infected by Koobface worm

Monday, July 13, 2009

Twitter on Friday said it was suspending user accounts that had been infected by a variant of the Koobface worm, which spreads itself by generating bogus tweets when the infected user logs in. The messages contain links to sites hosting the malware to infect other users.

Twitter said on its status blog Friday that the site was "suspending all accounts that we detect sending such bogus tweets."

Web security firm Trend Micro noticed a spike in Koobface activity on Twitter, saying on its security blog Friday that "a couple hundred" Twitter accounts were sending out the spam tweets over the span of a few hours.

Kapersky Labs, which detected the original Koobface worm last year spreading on Facebook and MySpace, said the number of variants had exploded from 324 to more than 1,000 at the end of June. The worm has been spreading on other social networking sites like Hi5, Bebo, Tagged, Netlog and, most recently, Twitter.

Comments and messages sent by the worm contain a link to a fake YouTube style website which invites users to download a phony Flash Player file that actually contains the worm.

"[T]he activity we've seen this month exceeds by far any other month in the past," said Stefan Tanase, a malware researcher at Kapersky.