Worm Attacks Yahoo IM Users

Ban Hammer · June 16, 2006

not seen this posted yet, although it's about 3 weeks old.

----------------------

A worm that spreads through Yahoo Instant Messenger is hijacking browsers and leading users to a site that installs spyware on their computers in a sign that instant messaging threats are becoming more malicious and powerful, security firm FaceTime Communications said Tuesday.

FaceTime Security Lab researchers said the self-propagating worm is currently rated as low-risk because it hasn’t spread widely but it can be malicious.

The worm infects the PC in two stages. In the first step, it installs a “safety browser” and hijacks the Internet Explorer home page, which is the first incidence of a malware installing its own web browser on a computer without the user's permission, researchers said.

The worm then spreads the infection to Yahoo Messenger contacts on the infected PC by sending a web site link during a conversation that when clicked restarts the cycle.

“This is one of oddest and more insidious pieces of malware we have encountered in years,” said Tyler Wells, senior director of research at FaceTime Security Labs. “This is the first instance of a complete web browser hijack without the user's awareness. Rogue browsers seem to be the hot new thing among hackers.”

The threat was first noticed on Friday by the India research arm of FaceTime Security Labs through a “honeypot” or a trap set by security companies to detect viruses, worms, and spyware. Most users who are infected by the threat are likely to get it when visiting a Yahoo chat room, said Mr. Wells.

The latest threat, despite its low-risk rating, is an indication of how the instant messaging security market has been steadily growing over the last few years, said experts.

Instant messaging is no longer a consumer tool and has been widely adopted by corporate organizations. About 93 percent of businesses in North America use instant messaging in the workplace, according to consulting firm Osterman Research.

About 80 percent of these organizations use consumer IM products, which leaves them susceptible to attacks from hackers. Consumer IM products lack strong security and protection features that many businesses need.

link