1 in 6 emails contains a virus: study

After Locky, here comes KePanger, PowerWare and Petya. According to a current analysis by Retarus security experts, 17% of all incoming email messages are blocked due to a suspected virus. The security experts are currently observing a significantly higher incidence of the crypto trojan Locky, as well as new variations. This corresponds to a fivefold rise in comparison with the previous month and can be explained primarily by the large increase in ransomware.

On average, in March, one in six emails sent to mailboxes used for business purposes contained a virus. In total, this means just as many infected messages occurred per hour as occurred per month in 2015 on average.

The analysis by the Retarus experts revealed that this can be explained by the huge rise in the incidence of crypto trojans. Whilst in February only around 3% of all incoming emails were infected, the number of messages filtered in March due to viruses had already risen to 17%. The reason: During this period, numerous additional versions of the virus appeared after the first Locky threat wave.

As crypto trojans can morph their structure quickly and frequently and, as a result, are able to assume the most diverse forms at lightning speed, ransomware is not detected immediately by every virus scanner. Nevertheless, security can be increased using professional cloud services. Specialized email security services access several scanners in parallel, thereby continuously expanding their filter rules, which means they can always offer the latest protection levels. Additional mechanisms, such as a four-level virus scan, also increase the likelihood of identifying and blocking extortion trojans in good time.

Heightened vigilance is essential
To ensure the best possible protection from attacks by Locky and similar ransomware, email users must be highly vigilant. Retarus recommends that users deactivate the automatic execution of embedded macro code in Office programs and that macros should only be activated if they are absolutely essential and where the corresponding documents originate from known sources.

In principle, users should only open email attachments if the sender or the process described in the email is trustworthy. So that potentially affected data can be restored quickly and - wherever possible - without losses, important data should be backed up on a regular basis. Here it should be noted that Locky can also attack external data media if this is permanently connected to the computer.

Caution is also advised in the event of an extremely slow processor response, elevated hard drive activity without a detectable reason, or files with the extension .locky on the hard drive. To close existing gaps in security, the latest versions of virus scanners should always be installed and regular patches performed.

Cyber criminals using email scam to spread virus via WhatsApp

MILLIONS of WhatsApp users are being warned to watch out for a fake email that will install a dangerous virus on their phones.

Clever cybercriminals have created the malware which is specifically designed to trick WhatsApp users on either iPhones or Android devices.

The virus is being circulated via email and is designed to look like it’s been sent by a legitimate source, researchers at Comodo Labs say. Fraudsters hope users will open the scam email and download the attached virus, which then infiltrates their phone.

Emails from the criminals contain sneaky subject lines including, “new voice message” or “an audio memo was missed” followed by a play button.

Others have received messages including “a brief audio recording has been delivered”, “a short vocal recording was obtained” and a fake notification about a video note.

Although none of the emails come from a WhatsApp address they are “disguised with an umbrella branding”, Comodo confirmed.

WhatsAppers should be aware that all voice memos, audio memos, recordings and notifications will be received in the app only.

Every scam email contains a compressed ZIP file which unleashes the secret malware into your phone when downloaded. The virus then duplicates in multiple system folders and adds itself into an auto-run in the computer’s registry.

“Cybercriminals are becoming more and more like marketers, trying to use creative subject lines to have unsuspecting emails be clicked and opened to spread malware,” said Fatih Orhan, a director of Comodo Antispam Labs.

“As a company, Comodo is working diligently in creating innovative technology solutions that stay a step ahead of the cybercriminals, protect and secure endpoints, and keep enterprises and IT environments safe.”

Researchers Show Malware Can Hack Gmail App With 92% Success Rate

Researchers claims a new piece of malware can steal highly sensitive data from smartphone apps on Android, Windows Phone and iOS with up to a 92% success rate.

The researchers have showcased the proof-of-concept malware running on an Android smartphone with the malicious software able to steal information such as login details, credit card numbers and even sensitive pictures taken with the victim's smartphone camera.

The researchers have not shown the attack working on iOS or Windows Phone operating systems, but they believe that the weakness exists in both platforms to carry out similar attacks "because they share a key feature researchers exploited in the Android system."

One of the researchers, Zhiyun Qian, said: "The assumption has always been that these apps can't interfere with each other easily. We show that assumption is not correct and one app can in fact significantly impact another and result in harmful consequences for the user."

Benign
The attack only works if the attackers can get their victims to download what looks like a benign application, which is in fact a piece of malware. While this can be done on Android through third-party app stores, it is not as easy on iOS, while Apple only allows apps to be downloaded from the official App Store.

For the attack to work, say the researchers, it must happen at the exact time the victim is inputting the sensitive information the attackers are after.

In order to achieve this, the researchers have exploited "a newly discovered public side channel" - the shared memory statistics of an app's process, which can be accessed without any privileges.

The malware is constantly monitoring for changes in the shared memory of the target app (which can be anything from a banking app to Gmail or Amazon) and once the malware notices a change to what the researchers have called an "activity transition event" - such as taking a picture or logging into your Gmail account - the malware takes over and begins capturing the data.

92% successful
The researchers have released three videos (which can be seen here) showing the exploit in action, capturing login details, credit card information and pictures.

The researchers tested the malware against seven different apps including Gmail, Amazon, Newegg, Hotels.com and an app from Chase bank.

Of the apps tested Gmail was the most vulnerable with a 92% success rate in capturing sensitive data, while Amazon was the least vulnerable with just a 48% success rate.

The reason for the Amazon app's lower vulnerability according to the researchers was because it allows one activity to transition to numerous other activities, making it more difficult to guess which activity the app was using.

IBTimes UK contacted Google for a comment on the report with a spokesperson saying they are looking into the matter.

The researchers will publish their full report, called Peeking into Your App without Actually Seeing It: UI State Inference and Novel Android Attacks on Friday, 22 August at a security conference in San Diego.

The authors of the paper are Zhiyun Qian, of the Computer Science and Engineering Department at University of California; Z. Morley Mao, an associate professor at the University of Michigan; and Qi Alfred Chen, a Ph.D. student working with Mao

Yahoo wants to encrypt all of your email, with Google’s help

Yahoo will offer its users full end-to-end email encryption and compatibility with Google’s own end-to-end email encryption at some point in 2015, CNET reports, as Yahoo chief information security officer Alex Stamos on Thursday confirmed the company’s email encryption plans at the Black Hat conference.

End-to-end email encryption will make it harder for third parties to snoop on user data, and it’s a step forward for Yahoo, which has already encrypted email at the data center level. The company hopes to work with other email providers in the future, in addition to Google.

“What this means is that eventually not only will Yahoo Mail users be able to communicate in an encrypted manner with other Yahoo Mail users, but also with Gmail users and eventually with other email systems that adopt similar methodologies,” Stamos said.

“We don’t have any other providers to talk about yet, but the hope is that this is open and will be adopted by many others in the email ecosystem,” a Yahoo spokeswoman said.

Yahoo will be offering its encryption source code to the community this fall, just like Google, hoping that its security will be further improved with help from Yahoo Mail users.

Combined, Google and Yahoo have almost 700 million email users, with Yahoo’s email usage estimated at over 273 million accounts.

Do We Want Google To Have This Much Power; Child Pornographer Caught By Gmail Scan.

A slightly disturbing piece of news: a child pornographer has been caught as a result of Google scanning his emails for known images of child abuse.

Hundreds of millions of email accounts are now being routinely scanned for illegal images, thanks to sophisticated new Google software

"Technology giant Google has developed state of the art software which proactively scours hundreds of millions of email accounts for images of child abuse.
The breakthrough means paedophiles around the world will no longer be able to store and send vile images via email without the risk of their crimes becoming known to the authorities.

Details of the software emerged after a 41-year-old convicted sex offender was arrested in Texas for possession of child abuse images.

Police in the United States revealed that Google’s sophisticated search system had identified suspect material in an email sent by a man in Houston. 

Child protection experts were automatically tipped off and were then able to alert the police, who swooped after requesting the user’s personal information from Google."

Yes, we know that Google has been scanning our Gmail in order to serve us ads. But this newer link into the criminal justice system is worrying. For of course such a tactic is not going to remain applied to one crime and one crime only. We can easily enough imagine extensions of it to mentions perhaps of drugs, or drug dealing. Or in countries with a rather lower level of protection for civil liberty than our own for certain buzzwords to do with the politics of those countries. And don’t forget that Google is subject to the laws of the countries in which it operates. If, say, China requires that emails that contain “Tiananmen Square” be reported to the Chinese security agencies then Google will have to comply or not do business in that country (and I think Google has declined to do some work inside China on that basis and Yahoo has not so declined).

The point being that having now shown that they can monitor email for the proof of one crime the company will come under ever greater pressure from a number of sources to apply the same monitoring techniques to evidence of other crimes. And there’s plenty of place around the world where it is criminal to do things we regard as being a lot more benign than child pornography. Even, places where it’s illegal to do things that we consider to be basic human rights. It seems to me inevitable that this technique, however just people may think it to be for this one particular crime, is going to expand out to many others.

Of course, one can simply not use Gmail, one can also simply not do anything that might constitute a crime, but it’s still worrying to me that our communications are to be so vetted.

Care2.com servers breached

Seems like friends around me are getting targeted for some reason. I received an email from a friend, which obviously looks like a phishing email. Here's the sample (click to enlarge):


If this is making its way around, it's got to be on Google. And so it is.

"Yesterday we discovered that Care2.com servers were attacked, resulting in a security breach. The hackers were able to access login information for a limited number of Care2 member accounts. Our team has worked to secure Care2.com against this type of attack from recurring.

To protect Care2 members we are resetting access to all Care2 accounts. The next time you login to Care2, you will be automatically emailed a new password, which will enable you to access your Care2 account as usual.

To secure your privacy, we highly recommend you immediately change your password for any accounts that share the password you previously used on Care2.

We sincerely apologize for this inconvenience. Given our large membership size, we have become a significant target for spammers and hackers over the past few years, and this was the first hacking attempt that successfully breached our protective walls. We take the security of our members very seriously and are taking this extreme step of changing all passwords to reduce the chances of any possible negative consequences."

More details here.

Has your account been pwned? New website will tell...

Security researchers have set up a website that allows punters to check whether or not their email addresses have appeared in data dumps slurped from compromised databases.

Hacking attacks on sites including Gawker and the network of Sony’s gaming division have led on to the publication of hundreds of thousands of users’ credentials online, sometimes (but not always) by activists at Anonymous.

That’s bad enough in itself but is even worse for users use the same login details for all their online activity – from email to online banking. Compromised firms normally make some effort to notify affected customers but this does not always happen.

A new site – called Pwnedlist.com - aims to plug this information gap. Users enter a username or email address into the site’s search box to find out if their username has appeared in any recent public data dumps. Users are not prompted to enter their password itself.

You can also use a SHA-512 hash of your email/username as input. Just don't forget to lowercase all characters first.

If a username or email address appears on the list, users are advised not to panic and to simply change their passwords. There’s also sensible advice of offer on password security even if credentials are not on the list.

New Hotmail security features against account hijacking

Microsoft has decided to introduce two new security features for its web-based Hotmail service, in the hope that this will make the accounts more difficult to hijack and eventual hijackings spotted faster.

The first one makes the use of extremely common passwords impossible. "Common passwords are not just 'password' or '123456' (although those are frighteningly common), but also include words or phrases that just happen to be shared by millions of people, like 'ilovecats' or 'gogiants,'" explains Dick Craddock, Program Manager at Microsoft.

The feature will be rolled out soon, and it will hopefully prevent successful brute force “dictionary” attacks.

The second one has already been released, and allows users to report compromised accounts to Microsoft immediately after receiving a spam or scam email from a contact's email account.

This can be done in two ways. Either you move the email in question to the Junk folder and you get offered the option of reporting the possible hack, or you mark it with the "My friend's being hacked!" option:


The feature also works for compromised Gmail and Yahoo! Mail email accounts, and Microsoft relays the information to Yahoo! and Google. In the few weeks since its release, this option has proved to be very helpful.

"When you report that your friend’s account has been compromised, Hotmail takes that report and combines it with the other information from the compromise detection engine to determine if the account in question has in fact been hijacked," says Craddock. "It turns out that the report that comes from you can be one of the strongest 'signals' to the detection engine, since you may be the first to notice the compromise."

The timing for the rollout of these feature could not be better - a recent report says that spammers are gradually shifting distribution from botnets to compromised accounts.

Thousands of Tumblr accounts compromised

Tumblr users have been targeted with an aggressive phishing campaign in the last week or so and are still being lured into entering their login credentials for access to adult content.

And it seems that the scheme is working very well - GFI researchers have accessed one of the dropzones for the stolen credentials and have discovered a massive amount of data.

What makes this phishing scheme stand out from others is the fact that the scammers are using the compromised Tumblr accounts to set up more and more phishing pages:


Various domains were also used to perpetuate the scam, including tumblriq(dot)com, tumblrlogin(dot)com and tumblrsecurity(dot)com - all registered in the last few weeks to bogus clients.

"The problem has become so pervasive that regular Tumblr users are setting up dedicated anti phishing sites to advise users of the problem," say the researchers.

Also, Tumblr has created an automated reply for people reporting the scheme, in which it advises affected users to reset the password for their account, to remove the fake login template by choosing a new theme and to "unfollow" all the blogs their account is following thanks to the scammers.

"What does somebody want with that many Tumblr logins?" ask the researchers. "We can only guess. The stolen accounts could be used as some form of advert affiliate money making scam, or maybe we could see lots of pages with survey popups pasted over them. There is the very real possibility that the Tumblr accounts are simply a way to test if those users are logging into other services with the same credentials - at that point, everything from email accounts to internet banking sites could be fair game."

Epsilon Email Breach Should Heighten Everyone's Awareness

It's unfortunate, but the largest email security breach has taken place this past week. Epsilon, an online marketing corporation who sends out over 40 billion emails a year had their list of email addresses stolen by sophisticated cyber thieves. Epsilon handled the email campaigns of some of the largest corporations in the country: Best Buy, Walgreens, JPMorgan Chase, Capital One, and more. The breach has put many internet users on heightened alert, and for good reason.

Many have stated that the breach didn't cause a whole lot of damage, as all the cyber thieves stole was a list of email addresses. However, with these addresses they can conduct one of the largest phishing attacks we've ever seen.

In an interview with a local news affiliate, Steve J. Bernas president & CEO of the Better Business Bureau serving Chicago & Northern Illinois gave this advice to users everywhere, "It's fairly common for identity thieves to impersonate credible organizations with what appears to be legitimate email messages seeking to verify account information" he continues, "Along with attempting to get personal information phishing attacks are often the source of potentially harmful computer viruses."

With so many of our emails floating out in the open, it provides us a stark reminder on how to keep our information safe. The first, and most obvious tip is to never provide account numbers or your social security number over an email. No valid company will ever require you to send important information like that over an email.

With the size and scope that Epsilon's client base covered, all sorts of businesses were affected. According to this report, Epsilon handled over 2,500 clients. With such a large number, phishing attacks could come from all sorts of different directions.

Epsilon has responded to the security breach, apologizing to all of those affected, "We are extremely regretful that this incident has impacted a portion of Epsilon's clients and their customers" continuing, "We take consumer privacy very seriously and work diligently to protect customer information."

While having a list of emails won't directly cause harm, it should put all of us at a greater level of awareness. Phishing attacks are more effective than a lot of people give them credit for. The only way to limit their effectiveness is to stay aware, and educate those around us on how to keep safe.

Christmas Spam in February?

Holidays like Christmas and Valentine’s Day inevitably come with threats related to the holidays themselves. These attacks have become more persistent throughout the years, perfectly timed to dupe the greatest number of users with the most appropriate social engineering techniques for their holiday of choice.

Just today, we saw a certain spam run that seems a little bit too late or, seen in another way, a little too early for the season it’s supposed to ride on.

Christmas greeting cards are being spammed out with messages similarly fashioned to those from popular websites known for free e-card sending services.

The messages arrive with a file attachment in .ZIP format, which the recipients must open to view the e-card. Of course, the file in the .ZIP file being an e-card is just as accurate as it is being the Christmas season in February. The .ZIP file contains malicious files that Trend Micro now detects as WORM_PROLAC.SME, WORM_PROLAC.AB, and WORM_PROLAC.AA. When executed, WORM_PROLAC.SME drops a file detected as TROJ_CUTWAIL.IZ. It also has rootkit capabilities that allow it to hide its processes and files from users. Similar to WORM_PROLAC.SME, WORM_PROLAC.AB has rootkit capabilities and drops several files detected by Trend Micro as TROJ_HILOTI.SMAE, TROJ_FAKEAV.SM3, and TROJ_HILOTI.SME1.

Such threats, it seems, will be seen as long as holidays are observed, as these events, in one way or another, affect users’ computing behaviors. Whether they’re deployed at the right time or not, users should remain vigilant and keep themselves protected.

Warning about "postcard" computer virus

With Thanksgiving and Christmas coming up, friends and colleagues are bound to send out bountiful of online e-greeting cards.

Warnings have been issued this weekend about a highly destructive computer virus which has been released under the guise of a postcard greeting.

It is strongly advised that computer users should not open any message with an attachment entitled “Postcard” or “Postcard from Hallmark”, regardless of who sent it.

The virus opens a postcard image which then 'burns' the whole hard disk C of your computer. Experts say that the virus will be received from someone who has your e-mail address in his/her contact list.

An American computer expert who has a senior position in Microsoft and is related to an Isle of Man resident said, “Even if you receive a mail called “postcard” and it appears to have been sent by a friend, do not open it! Shut down your computer immediately. This is the worst virus announced by CNN.”

The virus has been classified by Microsoft as “the most destructive virus ever”. It was discovered by McAfee on Saturday and so far there is no repair yet for this kind of virus. This virus simply destroys the Zero Sector of the hard disk, where the vital information is kept.

Webmail Account Compromises

Over the past week, I have been receiving pharma spam from friends' email accounts. It was obvious that their email accounts were compromised and used to relay spam.

One had a Hotmail account and another a Yahoo account. I’m not sure whether they should be mocked more for using accounts at those domains or for getting compromised.

Restoring Access
If this happens to you and you’re really fortunate, you’ll be able to log into your webmail account, change your passwords, and change the security questions used to reset the password.

If you can’t gain access because the bad guy changed the passwords, try using the lost password button. If you can’t reclaim your account that way, you’re going to have to contact the Google/Hotmail/Yahoo, whoever the website owner is. Good luck with that.

Cleaning Up
Review all your settings. In Google Mail check your Filters and your mail forwarding. Mail from your bank could now be forwarded to the bad guy.

Maybe its paranoia talking but I would search my mailbox for “password” to see if any other accounts might have been learned by the bad guy because a plain text password was available in your inbox.

Prevention
People always want to know how this happened to them. Often they jump first to blaming their webmail provider. While that’s possible, it’s not something you can really control. It’s better to start looking at simpler explanations that you can do something about.

Was your computer hacked? Did a keystroke logger gather your webmail credentials? That is certainly possible. And it doesn’t hurt to check out the computer. I would have to wonder why the spammer would gain your credentials and then use another computer to send the spam. Some webmail providers give full mail headers including the PC used to send the email. For the spam I received I could see it wasn’t the same country as the sender.

Were you phished or tab napped. Attackers manipulate victims into providing valid authentication credentials at fake sites. The best defense to this is to use bookmarks to avoid typos, and go directly to https sites where possible.

Did you use the account from an insecure computer or network. It’s so tempting to hop on an open access point at the coffee shop. It’s tempting to use the ‘guest kiosk’ at the hotel while on vacation. You don’t know the hygiene of that computer. You don’t know who is snooping on that coffee bar network.

Is your password really weak? I don’t think webmail providers would allow a lengthy bruteforce attack without locking out the account. But if your password is incredibly bad, this could still be a cause.

Was your password used on another service? While blaming the host isn’t my first thought, hosts do get compromised every now and again. There ae multiple account/password lists available from server compromises. If you’ve been on a system that was compromised and their password list stolen, if you reuse the same credentials than you have a problem.

Unfortunately the causes for account compromise aren’t any clearer than the ways to get your mailbox back. Hopefully this gives some food for thought.

Phishers Send Out Standard Chartered Spam

TrendLabs^SM recently encountered a phishing email specifically targeting Standard Chartered Bank clients. The spammed message instructs recipients to log in to their online accounts and to visit the Secure Messages section to read a specific message. The email body includes an embedded link, which when clicked leads to a phishing page.

Sample spam email:

Phishing page:

The use of bogus login pages has become a typical attack vector that phishers continue to use. Similar phishing attacks via spammed messages have been documented here in the Malware Blog:

• Phishing Pages Pose as Secure Login Pages
• Caisse d’Epargne Customers, Beware!
• Citi Prepaid Phishing Services

While this is an old trick, clients who visit the page may still unwittingly provide their bank credentials to cybercriminals’ waiting hands. Users are then advised to constantly exercise caution when opening email messages and when clicking embedded links. Standard Chartered Bank likewise reminds its clients to be wary of the reality of online threats, including phishing attacks.

Remember, when accessing you online banking account, never follow links from an email. Type in the address of you bank directly into the browser's address bar and go on from there.

And, if you get an email that supposedly comes from your bank, it's best to check on their official website for information about the issue or to call them directly.

Twitter, Google and Hi5 being abused in Prolaco worm distribution

Twitter, Google and the social networking site Hi5 are being abused in an email campaign to distribute the Prolaco worm.

27 out of the 41 AV engines detect the Prolaco worm at the time of article published.

Read more here.

Webmail phishing attack only the beginning

In the wake of the news reports this week of the large-scale webmail phishing attacks, much of the coverage has surrounded the compromise of email accounts which, according to the numbers, affected a massive amount of webmail users.

However, what has been glossed over is the potential impact on the other aspects of the victims' online lives. The bad guys likely now have more than just access to users' email accounts, they have access to a host of other online services the victim uses.

"A user's unique email address is often used to authenticate a number of web sites, including social networking sites and Instant Messaging on a public IM network," said Paul Wood, MessageLabs Intelligence Senior Analyst, Symantec. "If your email address has been compromised, not only should you change the password there, you should also change it on any other site that uses that email address as a log in ID."

Once the bad guys have email account information and the will to take over a related social networking accounts, all they need to do is try the password reminder links from the login pages. They can then not only use your email to spam, they can also gain access to other personal information stored online.

Over the last year, MessageLabs Intelligence has tracked a number of phishing attacks using Instant Messaging whereby the bad guys collected real IM user account information and passwords and used them to send commercial messages to everyone on the user's buddy list. An invitation to view a funny video or embarrassing pictures by clicking on a link in an IM was the bait and the landing site would then ask the victim to log in with their IM user name and password. For public IM networks, the user name is often the same as the web-based email account.

Phishing isn't the only way the bad guys can gain access to webmail accounts. MessageLabs Intelligence has been aware of an increase in the number of "brute-force" password breaking attempts, where dictionary attacks are used against online webmail accounts to break in, perhaps using POP3 or webmail to conduct the attacks. Users with simple or weak passwords are the most vulnerable. On the website, an attacker will be asked to solve a CAPTCHA puzzle to prove they are a real person. CAPTCHAs can be easily bypassed using a variety of CAPTCHA-breaking tools.

How Do They Know My Email Address?

Have you received email messages in the last several weeks with several random words in the subject line, and a random sentence in the message body? If your answer is yes, then you are one of the victims of the ongoing directory harvesting attack (DHA) by spammers.

The purpose of a DHA is to find valid email addresses on a domain for future spam attacks. During a DHA attack, any addresses for which the recipient’s email server accepts email are considered valid and will be added to the spammer’s address database to include in future spam attacks.

For example:

Sample #1:

From: joannjasmin8xs@xxxxxx.com
Subject: land

Those journalists showed them a photograph.

Sample #2:

From: clariceboldin9cg@xxxxxx.com
Subject: okay then

They told her the shortest way.

DHA is more than just an annoyance for email recipients. Every successful DHA attack equals one or more email address being subjected to future spam/malware attacks. Furthermore, these attacks also generate a large volume of unnecessary workload and consume significant amounts of system resources on the recipient’s email server. Symantec is closely monitoring these attacks and will inform readers of any further developments.

Credits

Sober worm returns and uses social engineering techniques

PandaLabs has recorded the appearance of a new variant of the Sober worm, Sober.Y, which spreads using social engineering techniques in emails sent in English or German.

The worm uses two types of mail to propagate: Firstly, an email in English with the subject "Your new password," which tries to make users think it is notification of a change of password, asking them to check the data in an attached file, pword_change.zip.

Secondly, an email written in German claiming to contain a photograph of old school friends in the file KlassenFoto.zip. Both compressed files contain the executable PW_Klass.Pic.packed-bitmap.exe, which is a copy of the worm itself.

If the file is run, a false CRC error is displayed, even though the action has already started. The worm collects email addresses from files with certain extensions on the compromised computer, and sends itself out to them in the emails described above using its own SMTP engine. It will only use the German version of the email if the addresses end in .de (Germany), .ch (Switzerland), .at (Austria), or .li (Lichtenstein).

Even though the number of incidents recorded is low, this worm has significant propagation potential.

Spammers piggyback on Swine Flu outbreak

Researchers at McAfee saw a spike in swine flu spam over the weekend. In just that short amount of time this particular brand of spam accounted for two percent of all spam.

As might be expected, the spam is pharmaceutical-centered, advertising drugs and providing links to online pharmacies. The spam originates from a network of compromised, "zombie" computers, says McAfee. The security company expects swine flu related spam will increase and that many may contain links to malicious websites.

The subject lines combine scare tactics with celebrities the spammers think recipients might be interested in:

· First US swine flu victims!
· US swine flu statistics
· Salma Hayek caught swine flu!
· Swine flu worldwide!
· Swine flu in Hollywood!
· Swine flu in USA
· Madonna caught swine flu!

McAfee says there also has been an increase in the number of domain names containing references to swine flu, which could indicate a rise in malicious websites.

As always, watch what you click, and ignore, delete and report spam messages appearing in your inbox.

Gmail users hit by ViddyHo phishing chat attack

Fans of Google's email system have been the target of phishing campaign spreading via the Google Talk chat system.



The unsolicited instant messages urge Gmail users to "check out this video" by clicking on a link via the TinyURL service. The link, however, directs users to a website called ViddyHo - which asks surfers to enter their Gmail usernames and passwords.



This is, of course, a classic attempt to phish credentials from the unwary. The hackers behind ViddyHo could use the credentials they have stolen via their site to break into accounts, grab identity information and impact your wallet.

Because people are more used to receiving suspicious communications via email than instant messaging chat sessions, there's a chance that some users may be more likely to fall into the trap.

If you were unfortunate enough to fall for this scam - make sure to change your Gmail password immediately. In fact, also change your passwords on any other site where you might be using the same password as on Gmail.

As some 41% of people use the same password for every website they access, you can understand how letting your credentials fall into the wrong hands could be disastrous.

Potentially a hacker who has grabbed your Gmail password could have accessed your entire address book and scooped up all of your correspondence - including information that you may have archived about other online accounts.

The message is simple. You should always be wary of clicking on unsolicited links and be extremely careful whenever a website asks you for a username and password.

TinyURL has now blacklisted the site, meaning that their link will no longer work. However, there is nothing to stop the hackers using other URL shortening sites or setting up alternative phishing sites to try and steal from the unwary.