Scammers exploit Swayzee death

Posted by Emma Woollacott

We saw it with Michael Jackson, we saw it with Farrah Fawcett - a celebrity death is bonanza time for spammers. And Patrick Swayzee is no exception, with scareware alerts appearing within hours of his death.

The star of Dirty Dancing and Ghost died yesterday after a two-year fight with pancreatic cancer. Searching for more information online throws up what look like straightforward news stories.

Fake news story

But not for long - as this image suddenly appears.

Fake warning

And then this.

And a fake scan

Any mouse action on the image ends with the installer being downloaded.

So what are the spammers after? "One interesting detail is the rogue AV website includes a "geoip.php" that seems to be recording the city and country origin of each incoming connection," says Chu Kian of F-Secure. "Could be for statistics tracking; it also seems to redirect anyone going back to the website for a second look, so you can't return to the exact same page."

According to Sophos, the fake anti-virus program is the Troj/FakeAI-L Trojan.

"The tactic used by the cybercriminals on this occasion is the same as the one we saw after the death of Natasha Richardson and when they exploited interest amongst the public in the anniversary of the 9/11 terrorist attack last week," commented Sophos' Graham Cluely.

See also:
Jackson's death sparks wave of spam