Fake Google Site Hides Trojan Horse

Scammers have set up an exact copy of the download page for Google's Toolbar plug-in in an attempt to lure users to download a Trojan backdoor.

Reported by security outfit Surfcontrol, some versions of the scam even spoof the correct Google Toolbar web address for Internet Explorer, using Google's own redirection service in an attempt to hide the real, non-Google address.

The Trojan itself--W32.Ranky.FW--is designed to turn the PC into a bot zombie, and is spread using the conventional technique of asking recipients of a spam e-mail to follow an embedded link.

According to Surfcontrol, the version detected by the company fails because of poor programming of defective compilation, but it remains a proof-of-concept in how to attack users using a simple combination of convincing elements.

Clever Combination

Outwardly simple, the scam has a clever combination of tricks. Although using parts of established Web sites is standard in phishing scams, it is relatively unusual to go to the length of reproducing en entire page precisely, in combination with a convincingly-spoofed web address.

The fact that the spammed e-mail appears to come from Google could convince recipients to follow the link.

Assuming that a re-engineered version appears--highly likely--once infected, users will notice nothing untoward, although their PCs will have become part of a bot-controlled network.

Google has been attacked in similar way before. Last September, scammers faked the Google search page itself in order to aid the spread of a worm.

More recently, a Trojan attacked the company's adsense advertisements, replacing them, in-browser, with fake ones on any PC infected with the malware.