ID: IRCNE2012041476
Date: 2012-04-21
According to “ZDNet”, Kasperksy discovered a new spam campaign on Twitter pushing fake antivirus software. Since it is still ongoing, the numbers for it are likely much higher than what the security firm first reported: 540 compromised Twitter accounts sent out 4148 tweets, linking to a total of 44 unique domains (most of them hosted on .tk and .tw1.su).
A quick search on Twitter shows that the scam is still rampant.
The compromised accounts spammed up to 8 messages per second, with links sending users to the infamous BlackHole exploit kit. If you click one of these links, you’re prompted with the following bogus warning: “Windows Antivirus 2012 has found critical process activity on your PC and will perform fast scan of system files!”
You are then told a fast scan is occurring (not true), at the end of which you are invited to install the aforementioned malware. Kaspersky says it tested various links and found that several variants were pushed to the infected machines.
At one point, the campaign stopped and then restarted with renewed gusto. While it may look like it’s dying down, the malware writers behind it can always give it new life by using old or new fake Twitter accounts.
- 3