The mammoth StormWorm botnet has left off its usual strategy of using news headlines to lure people into clicking on badsite links that result in their computers being hijacked and added to the botnet — now it is using intriguing fictional events to bait its hooks:
The emails contain such headlines as 'Eiffel Tower damaged by massive earthquake' and 'Donald Trump missing, feared kidnapped.'
The bodies of the emails contain links which claim to provide further information on the story.
However, the links direct to a page designed to resemble adult video site Pornotube. When users click on one of the supposed video links on the page, an executable is launched which installs the Storm malware.
"This clever social engineering technique plays on people's inquisitiveness about news of natural disasters and celebrities," said McAfee researcher Kevin McGhee.
"The emails also follow the simple format of some text and a link that looks fairly harmless to the uneducated user."
The emails mark a deviation for Storm from its usual tactic of spamming articles and videos of current events and holidays.
(via Beyond the Beyond)
