BIRMINGHAM, Ala. - The director of research in computer forensics at the University of Alabama at Birmingham (UAB) says cyber criminals are using bogus messages claiming to be from the social networking site MySpace to connect unsuspecting users with Web pages that can deliver a virus capable of stealing victims' bank passwords and other sensitive personal information.
Gary Warner says the fake MySpace messages ask users to update their account information by following a link posted in the spam e-mail. The link takes users to a site that mimics the MySpace login page. Once signed on to the bogus page, users are offered a download called the "MySpace Update Tool." Warner says clicking the download delivers malicious software to users' computers.
"These cyber criminals want to make users believe that they've logged on to a genuine site. They show the login page and ask for login information, but that is simply a mechanism being used to make users believe the page is legitimate," Warner says.
"The criminals don't necessarily want your MySpace log in information," he says. "What they want is to win your trust so that you'll follow their download instructions - and, unfortunately, anyone who clicks that download link will be downloading a version of the ZBot virus, which has the capacity to steal bank passwords and other financial and personal information."
Warner says the fake MySpace e-mails are arriving in users' mailboxes with a range of subject lines including:
- MySpace Account update
- Please update your MySpace account
- Update your MySpace account
- You are required to update your MySpace account
- Your MySpace account
"Users should not consider messages coming into their inboxes with these kinds of subject lines because legitimate companies never ask for account updates via e-mail," he says. "Instead, they'll solicit information updates when you visit their sites directly through your Web browser."
Warner says he has been in contact with the security team at MySpace parent company Fox Interactive Media, and the group is taking an active role in terminating the malicious Web sites.
Learn more about the MySpace spam campaign at Warner's blog: http://garwarner.blogspot.com/.
About UAB
UAB Computer Forensics Research is on the front lines of cyber crime and takes a three-part approach in its response to the problem: academic training to prepare the next generation cyber crime investigators, increased public awareness of cyber crime and research to develop cutting-edge options for battling cyber criminals.