Spammers Exploit Death News of Celebrity to Distribute Malware

Cyber criminals once again perform their malicious deeds as they thrust Blackhat SEO links into the Internet with hopes of drawing large number of users who hunt for the latest updates on the death of Farrah Fawcett. Fawcett, star of Charlie's Angels, has recently died following an extensive fight with cancer at age 62, security company Trend Micro reports.

Reportedly, the web links from search results belong to the domain names 'is-the-boss' and they redirect surfers to unexpected websites that eventually lead to a fake AV installation.

In one particular case, the first link diverts surfers to another website within the same is-the-boss domain, and subsequently takes them to one more site, which contains referrer checks prior to revealing its content. The technique is one of evasion that cyber criminals use for bypassing security analysis or to avoid the search engines rating system.

After the person making the request is cleared, he is diverted to another pair of websites before eventually contacting him with a download web-page. This page downloads install.exe, a fake antivirus program identified as TROJ_FAKEAV.BBM.

As observed, whenever a news of famous personality hits the media, malware purveyors invariably exploit it, commonly by using e-mail as the attack vector. Hence, it is advisable that users should remain alert of spam mails presenting links that lead to 'pictures' or 'news' about deceased celebrities.

Spammers often take e-mail users to URLs that promote medicinal items like Cialis and Viagra. Even worse, they attempt to install malicious programs on users' systems. However, another method of attracting surfers searching for news is the Search Engine Optimization (SEO) technique.

Blackhats use this technique to increase the number of results on a search engine so that their results come in the top results. This way, more users can be driven to spurious sites offering so-called "additional information" of the latest popular news. Once users follow the bogus web-links, they become subject to a malicious attack, information theft, or malware/spyware installation.

Similarly, during the early May 2009, spammers took visitors to malware-infested websites when they searched for phrases 'farrah fawcett dead' although Farrah Fawcett hadn't died then.

Related article: Spammers Continue their Campaigns Successfully

» SPAMfighter News - 7/8/2009