Webroot warns on political Koobface data hijack

[JMH]

IT security vendor Webroot says it has discovered a pro-Israeli website apparently receiving passwords stolen by Koobface, the social networking worm that has been around for more than a year.

According to Webroot, Koobface - an anagram of Facebook - has been seen hijacking legitimate websites for more than a year, using them not only to host malicious payload files, but also to work as proxy command-and-control servers for the botnet.

Andrew Brandt, a senior security researcher with the firm, says that one such hijacked Web domain - migdal.org.il - recently popped up in a number of blog posts and on websites which list the domains used to host malware, as far back as this past May, when the Koobface crew began using a slew of new hijacked servers as distribution points for its malicious files.

"And since the summer, Koobface has been delivering a password stealing trojan among the several payloads it brings down to an infected computer", he said in a security blog posting yesterday evening.

The trojan's name, he says, is migdal.org.il.exe, and the stolen passwords it scrapes from infected computers are sent right back to the migdal.org.il web server, which is physically located at an ISP in the UK.

More -
Infosecurity (UK) - Webroot warns on political Koobface data hijack