Spam botnet using fake news to lure victims.
The Storm worm has temporarily abandoned its tactic of using recent news happenings in its spam and is instead fabricating current events.
Researchers are reporting a new round of spam messages tied to the Storm network which touch on fake, sensationalized news stories. The emails contain such headlines as 'Eiffel Tower damaged by massive earthquake' and 'Donald Trump missing, feared kidnapped.'
The bodies of the emails contain links which claim to provide further information on the story. However, the links direct to a page designed to resemble adult video site Pornotube. When users click on one of the supposed video links on the page, an executable is launched which installs the Storm malware.
"This clever social engineering technique plays on peoples inquisitiveness in news of natural disasters and celebrities," said McAfee researcher Kevin McGhee.
"The emails also follow the simple format of some text and a link that looks fairly harmless to the uneducated user."
The emails mark a deviation for Storm from its usual tactics of spamming fake articles and videos of current events and holidays. They also build on a recently-discovered attack in which the worm was spread through a fake claim about Beijing Olympics being cancelled.
"There mustn’t be much going on in the world today as the Nuwar spammers have moved from jumping on real news of natural disasters and current affairs to creating their own fictional events," noted McGhee.
"This high volume spam campaign is using some wacky subjects to lure people into clicking on the links."