Koobface gang starts tracking success

gallery

The makers of the Koobface botnet are now tracking how popular their trick websites are with a sneaky piece of JavaScript code.

The tracking code has been spotted on fake YouTube pages synonymous with the bot, allowing the gang behind Koobface to monitor page hits, revealed Trend Micro's advanced threat researcher Joey Costoya.

Costoya explained in a blog post that this code is found at the very bottom of the fake pages, below numerous “
” tags.

Data viewed by the researcher from the hit count page showed the gang began using the monitoring method on 28 July and he saw there had been 126,717 unique page hits since then.

“There’s no actual data in the hit count page on how many users actually ran the Koobface loader," Costoya said.

"Let’s just hope that a substantial portion didn’t fall for the fake YouTube page trick."

Koobface has previously targeted online services containing shared content and has hit a number of notable sites since its birth.

Last year, it struck Google Reader users, as well as hitting Facebook, and was ranked as a serious threat by F-Secure.

Email to a friend

Print this page