The Tech Herald

Financial Malware now targeting Facebook accounts

by Steve Ragan - Jan 6 2012, 13:00

Financial Malware now targeting Facebook accounts. (IMG:J.Anderson)

Malware, which was discovered in 2010 and used to target financial data, has been reengineered to target Facebook, according to researchers from Seculert. So far, a single list of 45,000 credentials - primarily from France and the U.K. - is the only proof of the new modification.

The Malware in question, Ramnit, is described by Microsoft as a “multi-component malware family which infects Windows executable as well as HTML files.”

Security firm Trusteer concluded that Ramnit started targeting finances shortly after the source code for the Zeus family of Malware was leaked to the web.

In addition, Trusteer said that Ramnit’s developers merged several financially-based attack vectors to create a hybrid family of Malware; capable of bypassing additional layers of security such two-factor authentication.

“We suspect that the attackers behind Ramnit are using the stolen credentials to log-in to victims' Facebook accounts and to transmit malicious links to their friends, thereby magnifying the malware's spread even further,” Seculert said.

Expanding on that, Michael Sutton, VP of Security Research at Zscaler, added, 'Ramnit is a reflection of a shift that has been ongoing in the malware domain for some time.”

“Ramnit was not initially designed to harvest Facebook credentials, but the Ramnit maintainers have recognized the value of Facebook accounts for propagation. Whereas email can be easily spoofed and is therefore more likely to be ignored, receiving communication from a trusted contact on Facebook will have much higher click-through rates. Victims are simply not aware that the 'trusted' Facebook account, from which the communication was received, may itself have already been compromised...”

Seculert said they provided Facebook with a complete list of compromised accounts. They noted that the tendency to recycle password could play a role in using the harvested Facebook credentials to access VPN services, email, and various other accounts online.

At its peak, Ramnit was able to compromise some 800,000 systems in the final quarter of 2011.

Around the Web

Comment on this Story

comments powered by Disqus

From Autosaur.com

Shelby GT350 Mustang Pictures

We have added a bunch of pictures of the all-new Shelby GT350 Mustang from Ford. The ne...

All-new Shelby GT350 Mustang

Ford have revealed details of the new Shelby GT350 Mustang. First introduced in 1965 the new...

Best Cars To Buy In 2015

Leading vehicle research company Kelley Blue Book has released its list of the best cars to ...

A.C. Milan Take On Audi R8

Five A.C. Milan stars take on an Audi R8 in a game of street soccer in a new ad for Toyo Tir...

Jaguar 2016 F-TYPE R Coupe All-Wheel-Drive

Jaguar has unveiled the 2016 F-TYPE R Coupe, the first to feature all-wheel-drive. The 2016 ...