Virus writers are targeting Skype users with a new Trojan that poses as the latest version of the popular VoIP software.

Net security firm MessageLabs has detected and blocked more than 800 copies of a new variant of the MyTob (AKA Fanbot) Trojan, which is being distributed by email. References and nicknames contained in the code lead MessageLabs to conclude that the malware was probably created by a well known Chinese black hat hacker and not the original author of the malware strain.

Maksym Schipka, a senior antivirus researcher at MessageLabs, said the malware is the first he's aware of that mentions Skype and as such represents a new theme for social engineering attacks.

The malware arrives in an attachment in messages posing as the latest (v1.4) release of Skype. Legitimate downloads of the software only came out last week, so the attack is timely. If users open the infected payload on a vulnerable Windows machine they will find their PCs transformed into zombie clients (theoretically at least) under the control of computer hackers.

Schipka said that compromised machines fail to connect to IRC servers so they are not much use to the bad guys, right now. He added that the release of a variant of MyTob by someone other than the original author showed the source code was available in at least "some circles" of the computer underground. ®

Related stories

• Skype Trojan wiretap plan leaks onto the net (29 January 2008)
• Skype Trojan steals login credentials (17 October 2007)
• Skype IM malware smut surfaces (16 April 2007)
• Warezov worm fiends target Skype (28 February 2007)
• Security vendors talk up VoIP threats (9 January 2007)
• Fugitive CEO tracked down to Sri Lanka after Skype call (25 August 2006)
• Skype malware scam targets Turkey (10 August 2006)
• 'Skype clone' surfaces in China (17 July 2006)
• Botnet control fears over IP telephony (26 January 2006)
• Malware potency increases as numbers drop (25 January 2006)
• Skype aims for mainstream with new products (4 January 2006)
• Security threats soar in 2005 (7 December 2005)
• Analysis Anatomy of a failed virus attack (6 December 2005)
• Skype does video VoIP (1 December 2005)
• Motorola bundles Bluetooth for Skype (22 November 2005)
• Analysis Skype explains why security evaluation omitted bug reports (7 November 2005)
• October breaks malware production records (1 November 2005)
• Scramble to fix Skype security bug (25 October 2005)
• Arrests 'unlikely' to impact botnet threat (13 October 2005)
• Bot herder websites in internet take-down (13 September 2005)
• MyTob and NetSky-P dominate August viral charts (1 September 2005)
• Zotob arrests throws open trade in compromised PCs (30 August 2005)