Online scammers have been quick to capitalize on what will undoubtedly be one of the most significant news events this year: the death of Osama bin Laden.
Within hours of the news that the al-Qaeda leader had been killed by U.S. forces on Sunday, malware was found on sites optimized to show up on Web searches related to the event and in scams on Facebook.
Also, the blog site of a Twitter user based in Pakistan who now has more than 66,000 followers and who was posting tweets as the attack on bin Laden was happening, apparently was popular enough that his blog site was compromised and malware was embedded on it, according to a blog post from security firm Websense.
Visitors to the blog would not immediately have noticed anything as the malware was installed as a drive-by download without the visitor having to do anything, said Patrik Runald, senior manager of security research at Websense Security Labs. The malware searched for vulnerabilities in Internet Explorer, Java, and Adobe Reader that have been patched by the vendors, he said. If a hole was found, a display would pop up advertising "Windows Recover" a fake system scanner for Windows that tries to trick people into paying for software they don't need, according to Runald, who said it is unclear how long the blog was compromised before it was cleaned up around 8 a.m. PT today.
Around the Web, image searches and items labeled as video are proving particularly problematic as people are drawn to visual images of the terrorist leader. At least two domains were found to be serving up fake antivirus rogueware called "Best Antivirus 2011" on searches for "Osama bin Laden body" on a Google image search in Spanish, according to a blog post by Kaspersky Lab.
Another troublesome site involves a graphic doctored image of bin Laden. A Spanish language site was found to be displaying a photo that is supposed to be a shot of bin Laden after he was killed, accompanied by a news story about his death and what looks like a video. When the purported Flash Player window is clicked on, a message is shown prompting the visitor to update a VLC media player plug-in to view the video, Zscaler said in a blog post. Instead, an adware tool known as "hotbar" but labeled "XvidSetup.exe" is downloaded, the cloud security provider warned.
