Koobface worm begins to spread through Facebook, MySpace and Bebo

A new variant of the Koobface worm has begun spreading on the social networking site Facebook.

Rik Ferguson, senior security advisor at Trend Micro, claimed that he had received a Facebook message from a friend that contained a link to a spoof YouTube video.

Ferguson said: "The link had taken me to a site supposedly hosting a video posted by the same person that I had received the Facebook message from. In fact not only was the malicious landing page displaying his name, it had also pulled the photo from his Facebook profile. A very neat little piece of social engineering."

He further reported that clicking the install button redirected him to a download site for the file setup.exe, which is the new Koobface variant detected as WORM_KOOBFACE.AZ. This is hosted on an IP address in another part of the world and Trend Micro had seen more than 300 different unique IP addresses hosting the malicious .exe file, and it was expecting more.

Trend Micro engineers have revealed that WORM_KOOBFACE.AZ propagates through other social networking sites by first searching for cookies created by sites such as Friendster, MySpace, Bebo, Tagged and LiveJournal.

Ferguson said: "The worm connects to a respective site using login credentials stored in the gathered cookies. It then searches for an infected user's friends, who are then sent messages containing a link where a copy of the worm is downloaded. It also sends and receives information from an infected machine by connecting to several servers. This allows hackers to execute commands on the affected machine."