Koobface hackers now tracking victims

Koobface uses fake YouTube pages to ensnare victims

The hackers behind the infamous Koobface worm, which targets users of social networking sites, have added new code designed to monitor the success of their endeavours, according to security vendor Trend Micro.

One of the key elements of the bot is the use of fake YouTube pages designed to lure victims into installing what they believe is a codec needed to play a video.

"A few days ago, these pages started to include a short JavaScript code which enables the Koobface gang to directly monitor page hits," explained Trend Micro advanced threats researcher Joey Costoya.

"The tracking code is located at the very bottom of the page, which was pushed way below by a lot of
[line break] tags."

According to Costoya, the hourly tracking helps the gang to "correlate the user activity based on time of day and Koobface infection count". There have been almost 130,000 hits since tracking started last week, he said.

The news illustrates once again the increasingly sophisticated methods used by malware writers to improve the success of their initiatives.