The Tech Herald

Financial Malware now targeting Facebook accounts

by Steve Ragan - Jan 6 2012, 13:00

Financial Malware now targeting Facebook accounts. (IMG:J.Anderson)

Malware, which was discovered in 2010 and used to target financial data, has been reengineered to target Facebook, according to researchers from Seculert. So far, a single list of 45,000 credentials - primarily from France and the U.K. - is the only proof of the new modification.

The Malware in question, Ramnit, is described by Microsoft as a “multi-component malware family which infects Windows executable as well as HTML files.”

Security firm Trusteer concluded that Ramnit started targeting finances shortly after the source code for the Zeus family of Malware was leaked to the web.

In addition, Trusteer said that Ramnit’s developers merged several financially-based attack vectors to create a hybrid family of Malware; capable of bypassing additional layers of security such two-factor authentication.

“We suspect that the attackers behind Ramnit are using the stolen credentials to log-in to victims' Facebook accounts and to transmit malicious links to their friends, thereby magnifying the malware's spread even further,” Seculert said.

Expanding on that, Michael Sutton, VP of Security Research at Zscaler, added, 'Ramnit is a reflection of a shift that has been ongoing in the malware domain for some time.”

“Ramnit was not initially designed to harvest Facebook credentials, but the Ramnit maintainers have recognized the value of Facebook accounts for propagation. Whereas email can be easily spoofed and is therefore more likely to be ignored, receiving communication from a trusted contact on Facebook will have much higher click-through rates. Victims are simply not aware that the 'trusted' Facebook account, from which the communication was received, may itself have already been compromised...”

Seculert said they provided Facebook with a complete list of compromised accounts. They noted that the tendency to recycle password could play a role in using the harvested Facebook credentials to access VPN services, email, and various other accounts online.

At its peak, Ramnit was able to compromise some 800,000 systems in the final quarter of 2011.

Around the Web

Comment on this Story

comments powered by Disqus

From Autosaur.com

Aston Martin Vanquish Carbon Edition Pictures

Aston Martin have revealed some properly moody pictures of their new black and white Vanquis...

Nissan GT-R NISMO Available in Gran Turismo 6

Nissan and Sony have added the new Nissan GT-R NISMO to the in-game dealerships in  Gra...

2015 Kia Soul EV Prices

Kia have announced prices for their all-new Kia Soul EV. The company says this is their firs...

Celebrity Photographer Uli Weber Lauches New Goodwood Revival Book

Celebrity and fashion photographer Uli Weber is to launch a new book at this year’s Goodwood...

The Gorgeous Aston Martin Virage Shooting Brake Zagato (PICS)

World-famous Italian car design firm Zagato have revealed pics of their new one-off Aston Ma...