Merry Christmas, You’re Infected

It’s no surprise spammers and hackers have already launched Christmas-themed attacks; just as certain as testy crowds at the mall, they capitalize on whatever the current cultural meme may be. McAfee warns the latest attempts at infection come cloaked in familiar, legitimate labels.

The first one the security company warns about is a Hong-Kong-based spam campaign containing a Christmas theme lifted from a legitimate website, but the link leads to an IP address hosting an “old school” IRC/Bot SFX package.

The second one is a bit more sophisticated, introducing a newly created worm and appearing to be from major, familiar companies. The emails contain the W32/Xirtem@MM worm, a self-replicating worm that emails itself to addresses harvested from infected machines.

Posing as email from and using Christmas images from the websites of Hallmark, McDonalds, and Coca Cola, the worm also has the capability of spreading via removable storage devices and peer-to-peer networks, says McAfee.

At McAfee’s AvertLabs blog, Vinoo Thomas warns, “In the coming weeks, these tactics will tend to evolve rapidly, from crude to sophisticated, as spammers increasingly use Christmas based themes to lure victims. With the level of sophistication seen in today’s threats, the malicious payload could easily be hidden within layers of obfuscation or clever social engineering, and could fool even the savviest of users who try to inspect an email before opening.”

He recommends, of course, McAfee’a Artemis Technology, which has already had real-time updating to protect users.

View All Articles by Jason Lee Miller