Anonymous Supporters Duped Into Downloading Zeus Trojan
What better way to start the work week than with a delicious slice of irony pie? The hacktivist group known as Anonymous spent the past year harassing websites and web users alike with a series of high profile attacks. Authorities responded by arresting Anons around the world, but new information shows that police weren't the only ones spanking Anonymous. Symantec says that an enterprising bot herder modified a link to one of Anon's voluntary DDoS tools to point to a file infected with the Zeus Trojan instead.
The link switcher altered the URL in a widespread Anon PasteBin guide on January 20th -- the day of Anonymous' self-proclaimed "biggest attack ever," in which they took down a host of government and industry websites in response to Megaupload's shuttering. The guide originally pointed to the Slowloris DoS tool. The modified guide pointed to the Zeus Trojan. Symantec reports the PasteBin guide with the malicious link was viewed over 26,000 times and tweeted by the YourAnonNews account and 400 others.
After being installed, the Zeus app downloads the Slowloris tool and actually participates in Anon's DDoS attacks in order to avoid being detected. Of course, while Slowloris is busy blasting websites, the Zeus app is busy sending cookies and financial login information to its master server.
"Not only will supporters be breaking the law by participating in DoS attacks on Anonymous hacktivism targets, but may also be at risk of having their online banking and email credentials stolen," Symantec says in conclusion. Anon supporters must be damning that silly so-called Golden Rule right about now.