Facebook users warned vs Dorkbot spy malware

Facebook users were warned Wednesday against a new variant of the Dorkbot malware that spies on their browser activities and spreads itself via Facebook’s Chat.

Security vendor Bitdefender said the malware, which it described as a worm, can spy on users’ browsing activities and steal their personal details.

“The Dorkbot malware poses as a .jpg image but is actually an executable file. As an IRC [Internet Relay Chat] bot, the malware is easily coordinated by the attackers from a control and command server. Besides stealing usernames and passwords, the botmaster may also order other malware downloads,” researcher Bianca Stanescu said in a blog post.

Presently, Stanescu said the malware mainly circulates in the United States, India, Portugal, United Kingdom, Germany, Turkey and Romania.

She noted a similar variant had been detected as early as 2011, and can update itself once installed on the victim’s computer.

“The dangerous software may hide its presence and prevent antivirus software from running vital security updates. Besides instant messaging, Dorkbot can also spread through USB devices,” she added.

According to Stanescu, this was not the first time the malware, which uses IRC to send and receive data, was repacked to avoid detection.

Also, Stanescu noted an uptrend in malware spreading via social networks in recent years.

But she also said heightened security awareness has helped slow traditional phishing attacks.

Yet, she said viruses are mostly propagated through Facebook scams such as “guess who viewed your profile” that trigger users’ curiosity.

She advised users to avoid clicking on suspicious links on Facebook chat or other IRC networks, even if they appear to come from friends. — LBG, GMA News