AIM worm in the wild
There was an article in the last few days about Instant messengers being a tempting new vector for viral infections… Well…. Incidents.org has information on a new AIM worm seen in the wild. It doesn’t travel via a security hole, but uses the good old standby of social engineering to get from place to place.
The user will receive the following AIM message:
“This AIM user has sent you a Greetings Card, to open it visit: http://greetings.aol.com/index.pd?source=christmastheme?my_christmas_card.COM”
It looks like the greetings.aol.com is obfuscated and is actually redirecting to another machine which attempts to load a version of sdbot.