Malware masquerades as YouTube video

Fake YouTube profiles are being used to push malware

Security experts are warning users of a new malware attack posing as a pornographic YouTube video.

Researchers at McAfee said that the newly-discovered attack attempts to lure the user to a malicious site by way of a YouTube page promising an adult movie.

YouTube's terms of service prohibit the posting of obscene content, and the company removes videos it deems inappropriate.

But the attack does not actually post the videos on YouTube. Instead, the attackers have constructed a fake YouTube user account.

Forum spam messages are then used to link to the profile pages, which in turn offer 'video' links hosted on an external site.

Believing the page to be hosting a legitimate YouTube video, the user follows the link which attempts to perform a number of browser exploits as well as a fake codec attack in which the user is told that an 'additional file' is needed to display the video.

McAfee has connected the malware site to previous attacks which used the lure of US election scandals and other current event coverage. The malware alters browser preferences and records internet activity.

In addition to keeping system and antivirus software fully patched, McAfee recommends that users follow best practice such as not following suspicious links or opening unsolicited downloads.