New Email Malware Spoofs YouTube, Distributes Malicious PDFs

By Stephanie Jordan
in

Red Condor yesterday issued a warning of a new sophisticated email malware threat that spoofs YouTube and uses a redirect on a compromised Web site to a common Canadian Pharmacy Web site to distribute malicious PDFs via drive-by download. Red Condor believes the pharmacy page is actually a red herring that has distracted many security researchers from the true motive of these campaigns, a stealth drive-by download to infect computers.

The company believes—as of morning June 9—the malware has not been detected by any anti-virus engines, and comes in the form of a malicious PDF download. Red Condor has captured 10 versions of the malicious PDF, which likely exploits vulnerabilities in Adobe Acrobat. The campaign appears to be part of a much larger attack first detected by the company several weeks ago and has also recently spoofed Facebook and Twitter, among other popular brands. As unsuspecting users wait for what they believe is a YouTube or Twitter friend request, a greeting card, or even a Facebook login page to load, their browsers download and execute the malicious code, and then the Canadian Pharmacy page appears.

“The amount of effort behind these new campaigns is not commensurate with the typical Canadian Pharmacy spam campaigns that we have seen in the past. It’s the primary reason we started to suspect weeks ago that these campaigns have an ulterior motive and are more than just a series of mundane Canadian Pharmacy spam,” explains Dr. Thomas Steding, CEO of Red Condor. “After analyzing this threat over the past several weeks, we now believe that this malicious drive-by downloading may be a new trend; a double-purposing spam campaign, or a twist on the blended threat spectrum of attacks we have seen so prevalent in the past year. Spammers are starting to use social engineering hooks, including those common with phishing attacks, which will generate clicks. If users click on the spam link, there is an opportunity for a sale and to steal their identities while infecting their computers—a sophisticated one-two punch.”

One reason the malware has been difficult to identify, notes Red Condor, is the level of sophistication. The malware is served only if it thinks it can infect, and even then only upon the first request. The company says subsequent, identical requests from the same IP address do not result in the malware download and that this level of intelligence and effort might prevent traditional email security solutions from identifying this new threat.

Published June 10, 2010