Spammers use YouTube to spread Storm worm

In yet another twist to the Storm worm menace, spammers are using a fake YouTube site to trick users into downloading malicious code which could turn their PCs into bots.

In line with the trend for virus writers to use Web sites hosting malicious code to infect vulnerable PCs, the latest effort to spread the Storm worm attempts to hijack the YouTube name to cause infections. Using a site which carries YouTube branding, those behind the attack hope to capitalise on the popularity of the video sharing Web site to trick unwary users.

Those who fall for the trick are directed to a site which includes a link to a downloadable video file carrying the Storm worm.

Using typical social engineering techniques, an e-mail containing a link to the fake YouTube site is distributed as spam, with the message: "Man you have got to tell me where you picked her up. I saw this on the web. It has to be you. Check it out yourself at..."

F-Secure's chief research officer, Mikko Hypponen, has been monitoring the so-called Storm/Zhelatin Gang thought to be behind the worm. He recently created an online video showing how the gang uses different exploits created for vulnerabilities unique to various browsers -- depending on the browser being employed, different files are sent to the user's PC.

The Storm worm was first reported in January , delivered via an executable e-mail attachment disguised as an e-greeting card. In recent months, however, spammers have changed their approach by attempting to trick users into clicking on links directing them to malware-infected sites.

Managed security vendor SecureWorks recently speculated the massive rise in occurrences of the Storm worm could be the precursor to a DoS attack on government or corporate Web sites.