The Storm Worm Dresses Up as a Dancing Skeleton

This just in: Criminal hackers use holidays for social engineering.

Actually, that was just in about 15 years ago. Malware posing as cute holiday greetings sent by e-mail is as old as the concept of e-mail itself. And yet today, Halloween 2007, a Storm Worm variant is spreading under the auspices of an animated Halloween greeting card that features skeletons cutting a rug to the Venga Boys’ “Boom Boom Boom.” EEEEEK! According to several vendors announcing the new scam, e-mails arrive with subject lines including: Happy Halloween; Dancing Bones; The most amazing dancing skeleton; Show this to the kids; Send this to your friends; Man this rocks.

By downloading the Janglin’ Bones Show, users will be mildly amused, or simply distracted, for approximately eleven seconds. During this time, their PCs will be infected with a variant of the Storm Worm, a persistent and resilient bot that allows remote control of the PC and has been used largely to mass-distribute spam. In fact, it’s likely that Storm was used to distribute the e-mail, which was timed perfectly, according to Graham Cluley, a vice president at Sophos anti-virus.

It appears that e-mail directs users to a website that cycles through several different pictures, all of which ask the user to click to see the “Ossified Follies.” Here’s one of the images, as captured by Sophos:

How fun does that look?!

It’s not yet clear how many people’s funny bones are connected to their dumb bones. But the e-mail’s distribution is widespread, increasing the number of people that likely fall for the scam.

As to why and how people, after so many years of these types of scams, continue to fall for them, Cluley says computer-savvy users shouldn’t rush to judgment.

“There isn’t much excuse for the computer savvy among us,” says Cluley, who found himself talking about the same problems as he did five years ago. “But say a man comes to your grandmother’s door and says he’s the telephone repairman, hits her over the head with a baguette and takes her pension.” (Cluley is English, in case you were wondering.) “Do you say, ‘You stupid old woman?’ No. You feel bad. You’re sympathetic. And you should be. Not everyone has been using e-mail for ten years. Not everyone knows better.”

Happy Halloween! Just don’t take candy—or e-mail—from strangers, okay?