Trojan that disguises itself as a Firefox extension

[cjolley]

http://www.heise-security.co.uk/news/76019

The antivirus specialists at McAfee have warned of a Trojan that disguises itself as a Firefox extension. It is currently being openly disseminated through spam emails that purport to come from Wal-Mart. If the recipient opens the mail attachment while running a Windows operating system, the Trojan then installs itself as a Firefox extension, presenting itself as a legitimate existing extension called numberedlinks. It then begins intercepting passwords and credit card numbers entered into the browser, which it then sends to an external server. McAfee has dubbed the Trojan "FormSpy," although the company is still currently categorizing its distribution as low.
...

Sheesh, what next?

[Dr Mordrid]

Not on my list.

[cjolley]

I don't really understand what use the real numberedlinks extention would have.
But I don't guess there's any reason to think they couldn't easily name it after some more popular extention.
Adblock update offered by email anyone?


PS I know, I know. You and I wouldn't fall for it. But a lot might.

[TnT]

As pointed out on Slashdot comments this technically is still a Windows virus because it's a VBS vulnerability that attaches itself to Firefox (that's how it bypasses the install this extension screen).

Firefox rejects extensions installed from unverified sources, so unless people manually add a server hosting the bad extension and then click "install it", it won't affect most Firefox users.

[KeiFront]

I've read somewhere that it installs itself via an IE exploit, can't find the link atm.