Koobface variant is resurfaced again. This time this virus is not only back but with added sophisticated and behaves like an usual Facebook user.

According to TrendMicro, it automates the following routines: Firstly register a Facebook account, and confirm an email address in GMail in order to activate the registered Facebook account. Unlike previous Koobface component, this new Koobface component is joining random Facebook groups, adding Facebook friends and even go further to post messages to Facebook friends’ walls.

Additionally, the profile created by this new Koobface component now appear to be a well-designed and yet completed profile page, with photo, birth date, favorite music, and favorite books, are all filled up in the respective column.

In the meantime, Facebook will need to crack down on the malicious links since the message posted on the Wall by this virus are directed to the usual bogus Facebook homepage or YouTube page hosting the Koobface loader component. For users, the best advice is to be cautious when confirming the friend requests, and don’t simply following the links posted on your Wall.

Source: available at http://www.trendmicro.com/vinfo/images/20091110_koobface_fb.gif, accessed November 10, 2009

Update November 22, 2009: This virus is probably still around as one of my friends’ Wall did appeared a similar message, as shown in the below picture.

Tagged as: