Malware Authors Launch Vuvuzela Trumpet Scams

As per the security firm Webroot, malware writers are currently using the noise maker 'vuvuzela' found in South Africa to deceive people into visiting malicious websites that infect their computers. Vuvuzela is the most annoying noise producer ever used in the Soccer World Cup history.

The security firm has revealed that people are tweeting the malicious links embedded in e-mails which reads - "OMG! Vuvuzela banned!" together with hashtags #vuvuzelabanned and #worldcup. The security firm further states that Google had recorded the number of malicious links to more than 16,000.

Webroot has highlighted that the tweets use different types of URL shortening services such as - bit.ly, dr.tl, tinyurl.com and is.gd. The objective behind the usage of URL shortening services is to hide the destination where the malicious authors want to divert computer users. This destination is nothing but a fake image hosting website "Image Sheep." When the user visits the website, his computer links to the network of botnet in the background.

When the user's browser accesses the fake page, it inserts a Java applet into the computer. It is easy to pick apart the file content, which contains more PHP scripts and Java applets that insert malicious file into the computer. The file also functions as downloader component Trojan-Backdoor-Protard (aka Gootkit) that installs additional malware and complex instructions.

Moreover, this is the second time in a week when Webroot has pointed towards vuvuzela-related malicious online scam.

In the third week of June 2010, Webroot security experts warned that World Cup fans should exercise caution against an online scam that present a software capable to remove the audacious noise from the trumpet (Vuvuzela) during TV broadcasts.

Links to different websites selling 'Anti-Vuvuzela Filter' have been widely circulating on different social networks. Andrew Brandt, malware Researcher at Webroot, said that the price tag (€2.95) would leave users empty wallet, as reported by v3 in the third week of June 2010.

Brandt further said that this was the first time when he had seen a fake AV (anti-vuvuzela). It's better to reduce volume of TV if vuvuzelas creating disturbance during the match.

Finally, these two fake campaigns are the latest one launched by cyber criminals to create disturbance among the football lovers who like to enjoy the match at their homes.

Related article: Malware Authors Turn More Insidious

» SPAMfighter News - 7/8/2010