Press Panda Security

It’s Christmas time at Twitter: New hacker campaign targets trending topics to spread malware

  • Numerous Twitter accounts have been created to spread malicious code through festive messages
  • Christmas is a popular time for hackers. Every year threats are spread via email and social media using Christmas-themed messages

According to PandaLabs, Panda Security’s anti-malware laboratory, cyber-criminals are exploiting Twitter to spread malware in festive-themed messages. Using methods akin to Black Hat SEO techniques, hackers are taking advantage of trending topics to position malware distribution campaigns. As we approach the holiday period, topics such as “Advent calendar”, “Hanukkah” or even “Grinch”, are among the most popular subjects used by hackers to entice users.

Thousands of tweets have been launched using festive-themed phrases, such as “Nobody cares about Hanukkah” or “Shocking video of the Grinch”, along with short URLs pointing to malicious websites.

Users that click the link will be taken to a page that infects systems with false codecs -by exploiting a security hole in PDF files (CVE-2010-2883), and tries to trick users into downloading a codec that is really a downloader Trojan, which in turn downloads more malware onto the compromised computer.

In addition to subjects related to Christmas, cyber-criminals are using other hot topics to spread their creations, including the Sundance festival, the AIDS campaign, the Carling Cup and tweets about the actor Morgan Freeman.

According to Luis Corrons, Technical Director of PandaLabs, “Social networks are becoming increasingly popular among hackers as a vehicle for spreading malware. Facebook and Twitter are commonly exploited with malicious ends, given their ever-increasing number of users and the false sense of security that they have as regards to posting content on these media. That’s why the number of clicks, and therefore infections, tends to be very high.”

Keep your computer safe this Christmas

With the increased risk over the Christmas period, PandaLabs offers users a series of practical security tips for using social media:

  1. Don’t click suspicious links from non-trusted sources. This should apply to messages received through Twitter, through other social networks and even via email.
  2. If you click on the links, check the target page. If you don’t recognize it, close your browser.
  3. Even if you don’t see anything strange in the target page, but you are asked to download something, don’t accept.
  4. If you do download or install an executable file and the PC starts to launch messages or behaves strangely, there is probably malware on your computer. In this case, you should check your computer with a free online scanner such as Panda ActiveScan.
  5. As a general rule, make sure your computer is well protected to ensure that you are not exposed to the risk of infection from any malicious code. You can protect yourself with the new, free Panda Cloud Antivirus solution.

You might also like

It’s Christmas time at Facebook, reports PandaLabs
- A new variant of a well-known virus uses Christmas to spread via Facebook - Christmas is...
Cyber-crooks use Twitter to infect users
- Criminals have created accounts in Twitter and published thousands of comments in them under...
Obama, Racism, Twitter and Facebook, an Explosive Combination to Spread New Malware, According to PandaLabs
-           Users receive a Twitter direct message with a link to a supposed video of U.S....
Beware of Valentine’s Day Malware Distribution Campaigns, PandaLabs reports
Here are some examples of malware that used social engineering to infect users on this festive occasion PandaLabs...



    [...] that contain malware. We have more details on the security threat and how you can avoid it below. PandaLabs reports that hackers are targeting such current or former Trending Topics as “Advent calendar”, [...]

    December 8, 2010 at 4:19 am Permalink

    [...] It’s Christmas time at Twitter: New hacker campaign targets … [...]

Leave a Reply

(will not be published) (required)