A worm targeting Skype's VoIP application is harvesting e-mail addresses and directing users to a range of sites hosting other malicious software, security vendors said Monday.

Once a machine is infected, the worm sends a malicious link via instant messages to other users in person's Skype contact list, according to F-Secure's blog.

The link leads to an executable file that downloads a Trojan horse capable of downloading other malicious software, F-Secure said. It then shows a photo of a "lightly dressed" woman.

The link also directs users to at least eight Web sites with information about Africa. It's not clear what type of scam or harm those pages intend, but some of the sites have advertising on them, indicating that it might be a click-fraud scam, said Graham Cluley, senior technology consultant for Sophos. Click fraud refers to the various tricks used to get clicks on advertising banners, which generate revenue for Web page owners.

Skype has been targeted by worms in the past, none of which have inflicted great damage, and this one may be no different. "I would think this thing isn't likely to spread terribly far and wide," Cluley said.

That's partly because malware spread via IM does not generally infect as many people as malware spread through more conventional routes, such as e-mail, Cluley said. Also, users can reply to a suspicious IM and ask the sender about the link, and the lack of a response can tip off the user that something is awry.

Some sophisticated IM malware can generate an automated response to trick the user into clicking on the link, but this one does not appear to have that capability, Cluley said. However, it does set Skype to "do not disturb" status, which blocks incoming calls and other notifications, and also prevents a user from responding to an IM, Cluley said.

F-Secure calls the worm "IM-Worm:W32/Pykse.A," and Sophos named it "Mal/Pykse-A."

The IDG News Service is a Network World affiliate.

Whitepapers

• The Trend from UNIX to Linux in SAP(r) Data Centers
• Getting in Compliance With Government Data Regulations By Leveraging Online Security Technology
• How to Offer the Strongest SSL Encryption
• Maximizing Site Visitor Trust Using Extended Validation SSL
• Seven Steps to Reducing your Security Risk
• The Latest Advancements in SSL Technology

View more SECURITY whitepapers

Webcasts

• The Secure Web Gateway. Mission Critical For Business - Webcast
• Mobile Data Security
• Best Practices for Deploying WAN Optimization for Disaster Recovery
• Key Considerations for a Successful 802.11n Deployment
• Solutions to the Toughest IT Challenges in Remote Offices
• Lowering the Cost of Email Archives

View more SECURITY webcasts

Special Reports

• The Evolution of Network Security
• Taking Virtualization Up a Notch
• The self-managed network

View more SECURITY special reports