Koobface makes (another) comeback
According to director of malware intelligence with ESET, Koobface's latest attack modus operandi is that it only infects users the first time the victim accesses the site.
Subsequent attempts generate what looks like a 404 error (page not found) and, says Harley, attackers do this to hamper the work of security researchers, so that it becomes more difficult to analyse subsequent differing versions of the malicious code.
Koobface, which was was first detected in late 2008, propagates by delivering Facebook messages to people who are 'friends' of a Facebook user whose computer has already been infected. Upon receipt, the message directs the recipients to a third-party website, where they are prompted to download what purports to be an update of the Adobe Flash player, but is actually the malware.
