Criminals use popular video call app names to distribute cyber threats

Video calling applications have become very popular as a result of social distancing measures and home confinement, as they allow us to be close to family, friends and coworkers. However, cybercriminals do not hesitate to use this fact to distribute different threats under the guise of popular applications.

In the current reality, Kaspersky experts investigated the current threat landscape for social gathering applications in order to guarantee the safety of users and help them to enjoy these forms of communication. The analysis found that Skype is the true “king” of virtual meeting applications with a total of 120,000 suspicious files using their name fraudulently to try to distribute threats such as malware, especially Trojans, and adware.

42% was posing as Zoom, followed by Webex (22%), GoToMeeting (13%), Flock (11%) and Slack (11%)

However, the investigation also found that other names of video calling services are used by cybercriminals, mainly to spread adware. Among the 1,300 detected suspicious files that do not use the Skype name, 42% posed as Zoom, followed by Webex (22%), GoToMeeting (13%), Flock (11%) and Slack (11%).

The most frequent are two families of adware: DealPly and Download Sponsor. Both families act as installers that display ads or download adware modules. This type of software generally appears on users’ devices when they download from unofficial online stores.

While adware is not a type of malicious software, it can pose a privacy risk.

In addition to adware, Kaspersky experts found several cases of threats disguised as .lnk files, which grant direct access to applications. The vast majority were actually detected as Exploit.Win32.CVE-2010-2568, a fairly old but widespread malicious code that allows attackers to infect some computers with additional malware.