Cybercriminals are exploiting users of social networking sites

In April, cybercriminals were seen exploiting users of major social networking sites in order to spread malware and spam surveys, according to GFI Software.

“In the same way that the popularity of social networking sites makes them a widely accepted tool for businesses to reach customers and elevate brand awareness, it also appeals to cybercriminals seeking a large pool of captive users to be targeted for malware and spam attacks,” said Christopher Boyd, senior threat researcher at GFI Software.

“Established sites like Facebook and Twitter have long been a breeding ground for new cyber-attacks, but now we are seeing scammers taking an interest in the popularity of newer sites like Pinterest in order to catch victims off guard and trick them into clicking on something they shouldn’t,” Boyd added.

Twitter users were the quarry of cybercriminals looking to distribute fake antivirus applications during a particularly vicious spam run, which tweeted a link labeled “must-see” from numerous compromised accounts and spam-bots. Followers unlucky enough to click on the links were directed to a site infected with a fake antivirus program.

Once installed, the program constantly alerted users that their machine was infected and requested payment to clean up the system. The next day, additional links used the Blackhole exploit kit to infect victims’ machines with malware before automatically sending them to a site that was hosting another scareware program called “Windows Antivirus Patch.”

Twitter was also used as a platform to take advantage of users on Pinterest, a social networking site which is rapidly gaining popularity. A spam campaign using the account “Pinterestdep” claimed to be offering Visa gift cards to users willing to provide their opinions about Pinterest.

Instead of being directed to a user feedback form, victims were sent to a site which required them to complete up to 11 reward offers and to refer three friends to do so as well. Scammers also took advantage of Tumblr users who mistakenly entered “Tublr” into their web browser when attempting to access the popular micro-blogging site and redirected them to a message that claimed the victim had been selected as a “daily winner.” Like the scam on Pinterest, the victim was then asked to fill out surveys or complete other offers in order to claim the prize.

In a rehash of a popular lure used previously on Facebook and MySpace, scammers tricked users into installing a fake application which promised to show them a list of people who had viewed their profile. The application did little more than tag the victim’s friends in a spam image in order to spread the fake application among their network and serve them with surveys that generate affiliate cash for the scammer.

“With countless studies being released which point to the regularity with which users are visiting their favorite social networking sites, it should come as no surprise that cybercriminals see these sites as prime targets for their attacks as they look to reach as many people as possible,” continued Boyd.