The Tech Herald

Financial Malware now targeting Facebook accounts

by Steve Ragan - Jan 6 2012, 13:00

Financial Malware now targeting Facebook accounts. (IMG:J.Anderson)

Malware, which was discovered in 2010 and used to target financial data, has been reengineered to target Facebook, according to researchers from Seculert. So far, a single list of 45,000 credentials - primarily from France and the U.K. - is the only proof of the new modification.

The Malware in question, Ramnit, is described by Microsoft as a “multi-component malware family which infects Windows executable as well as HTML files.”

Security firm Trusteer concluded that Ramnit started targeting finances shortly after the source code for the Zeus family of Malware was leaked to the web.

In addition, Trusteer said that Ramnit’s developers merged several financially-based attack vectors to create a hybrid family of Malware; capable of bypassing additional layers of security such two-factor authentication.

“We suspect that the attackers behind Ramnit are using the stolen credentials to log-in to victims' Facebook accounts and to transmit malicious links to their friends, thereby magnifying the malware's spread even further,” Seculert said.

Expanding on that, Michael Sutton, VP of Security Research at Zscaler, added, 'Ramnit is a reflection of a shift that has been ongoing in the malware domain for some time.”

“Ramnit was not initially designed to harvest Facebook credentials, but the Ramnit maintainers have recognized the value of Facebook accounts for propagation. Whereas email can be easily spoofed and is therefore more likely to be ignored, receiving communication from a trusted contact on Facebook will have much higher click-through rates. Victims are simply not aware that the 'trusted' Facebook account, from which the communication was received, may itself have already been compromised...”

Seculert said they provided Facebook with a complete list of compromised accounts. They noted that the tendency to recycle password could play a role in using the harvested Facebook credentials to access VPN services, email, and various other accounts online.

At its peak, Ramnit was able to compromise some 800,000 systems in the final quarter of 2011.

Around the Web

Comment on this Story

comments powered by Disqus

From Autosaur.com

Asian Market Gets McLaren 625C

Sportscar maker McLaren have announced they will release a special model just for the Asian ...

Mercedes-AMG C63 Pictures

We have added some great pictures of the new Mercedes-AMG C63. With a 4.0 liter engine ...

Mercedes-AMG C63 Details

Mercedes have released details of their new Mercedes-AMG C63. This top end of the C-Class li...

Volkswagen Beetle Classic Model Prices

Volkswagen has announced prices for the new limited edition Beetle Classic model. The new Cl...

Chevy Colorado And GMC Canyon Ship To Dealers

General Motors have started shipping their new 2015 Chevy Colorado and 2015 GMC Canyon to de...