– Cyber-crooks are posting comments on major Web 2.0 sites to reach as many users as possible

– This case stands out for the large number of videos affected, leading experts to conclude that automatic tools are being used
 

This is yet another example of how cyber-criminals are attacking popular Web 2.0 sites to distribute malware. Such attacks have previously been seen, to a lesser extent, on sites including Digg.com and Facebook. Now, PandaLabs, Panda Security’s malware detection and analysis laboratory, has detected up to 30000 videos on YouTube with comments containing links that point to a Web page designed to download malware. The comments are normally suggestive, claiming that the link will take users to a legal Web page with pornographic content. You can see an image here: http://www.flickr.com/photos/panda_security/3548358349/

However, when users click the link, they are taken to a page that spoofs the original and which is really designed to download malware. On this page, users will be prompted to download a file in order to be able to view the video. If they take the bait, users will really be downloading a copy of the PrivacyCenter fake antivirus http://www.flickr.com/photos/panda_security/3548358229/

This malware, when run on a computer, pretends to scan the system, supposedly detecting dozens of (non-existent) viruses. It then offers users the chance to buy the paid version of the antivirus to clean their computers. The ultimate aim of cyber-crooks is to profit from the sale of this ‘Premium’ version. http://www.flickr.com/photos/panda_security/3548362019/

“The technique of using malicious comments on YouTube is not new in itself. What is alarming however, is the quantity of links we have detected pointing to the same Web page. This suggests that cyber-criminals are using automated tools to publish these comments”, explains Luis Corrons, Technical Director of PandaLabs. All images are available here: http://www.flickr.com/photos/panda_security/tags/privacycenter/