Angelina Jolie
Spammers are again promising nude pics of Angelina Jolie

Spammers change tactics to beat security

Messages rapidly repacked and updated to evade filters

Clement James

Spammers are getting wise to the publicity and attention generated by their creations, security experts warned this week.

Security firm BitDefender said that a malicious message which promised nude pics of Angelina Jolie has again been repacked and updated to beat spam filters and antivirus software.

Advertisement

The malware uses news fragments naming celebrities, including Jolie, Britney Spears and Barack Obama, and directs unsuspecting users to a webpage that allegedly contains a video clip.

However, on visiting the compromised page the victims are shown an image impersonating a video player which links to a binary executable file.

In order to be able to watch the clip, users are advised to download an 'update' for Adobe's popular Flash player, which turns out to be infected with the Tibs.GZM Trojan.

The binary file starts downloading automatically, a practice known as 'drive-by download', installing other pieces of malware including the infamous Trojan.Peed.JPU used on a large scale in the Storm botnet.

The new spam campaign mostly targets computer users with limited knowledge of data security, as well as those who would deliberately ignore the common safety rules in order to gain access to sensational news.

"These email messages are part of a larger wave that attempts to infect the user with miscellaneous Trojans," said Bogdan Dumitru, chief technology officer at BitDefender.

"Initially designed as messages with a single structure, the number of variants quickly escalated to three: a category including a single-part, plain text body, another one with a HTML part, and a third category that uses the Opera Mail Client templates."

In order to increase the success rate of the attack, the spam uses a series of catchy keywords displayed inside the message body.

Despite the fact that each message uses different fake news flashes and headlines, all of them send the user to an URL that ends with either 'stream.html' or 'watchit.html'.

  • Have your say
  • Send to a friend
  • Print
  • Digg
  • Reddit
  • Share

Do you agree?

Related whitepapers

Related jobs

Most watched

Summit: Views From the Valley

V3.co.uk's US office weighs in on the information overload crisis

John Chambers speaks on collaboration

Cisco boss talks up new offerings

Analysis and Reports

Remote access - Three steps to getting connected

3.4 million UK professionals now work from home – is your company equipped?

Cost benefits of a global collaboration network

This white paper is a must read for organisations looking for evidence of the bottom-line benefits of high-definition video and voice communications

Poll

Impact of Information Overload poll

Impact of Information Overload poll

What is the biggest problem your firm faces as a result of the data explosion?

View poll results

Advertisement

White paper library

Keep up to date with the latest products, services and technologies from the world's leading IT companies; IThound.com brings you over 6,000 white papers, case studies and analyst reports.

Advertisement

Newsletter signup

Sign up for our range of FREE newsletters:

Existing User

Newsletter user login:

Enter email address to edit your newsletter preferences

Job of the week

Search thousands of IT jobs :

Search thousands of IT jobs:

Advanced search

Hiring now on ComputingCareers:

Related IT jobs

Search thousands of IT jobs :

Search thousands of IT jobs:

Advanced search

Advertisement

Spotlight

Information management

Summit: Quiz IBM experts on information strategies

Join our live chat session on Thursday at 11am to...

RIM discusses new developer tools

Blackberry exec on the latest offerings for programmers

Houses of parliament

Summit: Doubts raised over Tory plans for NHS records

Experts say data quality could be an issue

Researchers take down spam botnet

Researchers from security firm FireEye have been able to effectively...

Primary Navigation