Clampi Virus Targets Users at Banks and Credit Card Sites

Keeping up with the latest Web security threats is a daunting task, because viruses and trojans emerge, evolve, and spread at an alarming rate. While some infections like Nine Ball, Conficker, and Gumblar have hit the scene and immediately become the scourge of the cyber security world, others take their time -- quietly infiltrating more and more computers before revealing the true depth of the danger they pose.

One such slow grower is Clampi, a trojan that made its debut as early as 2007 (depending on who you ask) but is only now raising hairs outside professional security circles. Clampi primarily spreads via malicious sites designed to dispense malware, but it's also been spotted on legitimate sites that have been hacked to host malicious links and ads. Using these methods, Clampi has infected as many as half a million computers, Joe Stewart, of SecureWorks, told a crowd at the Black Hat Security Conference in July, USA Today reports.

Once installed on a PC, the trojan quietly waits for you to visit a credit card or banking Web site. When it detects you're on one of the roughly 4,600 financial Web sites it's trained to watch, it records your username and password, and feeds that information back to the criminals. Clampi can even watch for network login information, allowing it to spread quickly through networked PCs (e.g., those in an office). In fact, it seems that businesses have been the primary target of Clampi so far.

According to the Times Online, in July, an auto parts shop in Georgia was robbed of $75,000 when criminals stole online banking information using Clampi. The trojan was also used to infiltrate computers for a public school district in Oklahoma and submit $150,000 in fake payroll payments.

Part of what makes Clampi so worrisome is the sheer breadth of its reach. Most trojans of its kind only watch about 30 different financial sites, Stewart told Network World. Clampi, on the other hand, watches over 150 times as many. Additionally, the coders of the malware have closely guarded their creation, wrapping it in heavy encryption. That tactic has so far kept security experts from identifying all of the sites being watched by it.

As usual, the best defense starts with good browsing habits. Also, make sure to have an up-to-date anti-virus package installed and a quality firewall set up. The Telegraph also suggests making all online purchases with a pre-paid credit card, in order to limit the damage in the event your computer does become infected.

If you are unsure if your company network is safe, please contact WebAddo at 770-217-7350 as soon as possible. Security measures can be implemented that will ensure the privacy and security of your sensitive data and information.