The Tech Herald

Financial Malware now targeting Facebook accounts

by Steve Ragan - Jan 6 2012, 13:00

Financial Malware now targeting Facebook accounts. (IMG:J.Anderson)

Malware, which was discovered in 2010 and used to target financial data, has been reengineered to target Facebook, according to researchers from Seculert. So far, a single list of 45,000 credentials - primarily from France and the U.K. - is the only proof of the new modification.

The Malware in question, Ramnit, is described by Microsoft as a “multi-component malware family which infects Windows executable as well as HTML files.”

Security firm Trusteer concluded that Ramnit started targeting finances shortly after the source code for the Zeus family of Malware was leaked to the web.

In addition, Trusteer said that Ramnit’s developers merged several financially-based attack vectors to create a hybrid family of Malware; capable of bypassing additional layers of security such two-factor authentication.

“We suspect that the attackers behind Ramnit are using the stolen credentials to log-in to victims' Facebook accounts and to transmit malicious links to their friends, thereby magnifying the malware's spread even further,” Seculert said.

Expanding on that, Michael Sutton, VP of Security Research at Zscaler, added, 'Ramnit is a reflection of a shift that has been ongoing in the malware domain for some time.”

“Ramnit was not initially designed to harvest Facebook credentials, but the Ramnit maintainers have recognized the value of Facebook accounts for propagation. Whereas email can be easily spoofed and is therefore more likely to be ignored, receiving communication from a trusted contact on Facebook will have much higher click-through rates. Victims are simply not aware that the 'trusted' Facebook account, from which the communication was received, may itself have already been compromised...”

Seculert said they provided Facebook with a complete list of compromised accounts. They noted that the tendency to recycle password could play a role in using the harvested Facebook credentials to access VPN services, email, and various other accounts online.

At its peak, Ramnit was able to compromise some 800,000 systems in the final quarter of 2011.

Around the Web

Comment on this Story

comments powered by Disqus

From Autosaur.com

Car Games Update August 30th

We have added a few new games to the car games section of Autosaur. First up is the Car Eats...

2015 Toyota Tundra TRD Pro Prices

Toyota have announced prices for their 2015 Tundra TRD Pro, based on the Tundra it includes ...

2015 Toyota Tundra TRD Pro Pictures

Toyota recently announced prices for the 2015 Toyota Tundra TRD Pro. We have added some...

2015 Dodge Challenger Mopar Challenger Drag Pak Pictures

Mopar have been showing off their 2015 Mopar Challenger Drag Pak test vehicle at the Nationa...

Ford Customers Test 2015 F-150

Ford have selected four customers from the 15,000 who applied to be first to test the latest...