Twitter goo.gl worm running rampant

[djbaxter]

Twitter worm hits goo.gl, redirects to fake anti-virus
By Ryan Naraine, ZD Net
January 20, 2011

A fast-moving Twitter worm is in circulation, using Google?s goo.gl redirection service to push unsuspecting users to a notorious scareware (fake anti-virus) malware campaign.

At 8:45 a.m EST today, this Twitter search shows thousands of Twitter messages continuing to spread the worm.

According to malware hunters tracking the threat, the worm?s redirection chain pushes users to a Web page serving up the ?Security Shield? Rogue AV. The page is using obfuscation techniques that include an implementation of RSA cryptography in JavaScript to obfuscate the page code.

Kaspersky Lab malware researcher Nicolas Brulez (see important disclosure) said the original ?goo.gl? links in the Twitter messages are redirecting users to different domains with a ?m28sx.html? page. That page then redirects to a static domain with a Ukrainian top level address.

Read more...

 

[Linda Buquet]

Sheesh, saw that coming. Glad I don't use Twitter or goo.gl much these days.

 

[BlogDiva]

I've also completely stopped using Twitter - I got so tired of all the junk tweets! Thanks for the alert.