Worm lures victims with 'Naked World Cup' subject line

Soccer purists can breathe a sigh of relief. There is no Naked World Cup.

IT professionals, on the other hand, may want to be a little more vigilant, as a new e-mail worm is on the loose that preys on the intense worldwide interest in the international sporting event.

Called Sixem-A, the worm began circulating earlier this week, and has just recently been blocked by antivirus vendors. So far, the worm has been detected at only a handful of companies, but it is the first World Cup 2006 malware to target an English-speaking audience, said Graham Cluley, a senior technology consultant with Sophos PLC.

Victims receive messages with subjects like "Naked World Cup game set," or "Soccer fans killed five teens," and are encouraged to click on an e-mail attachment, which appears to be an image. In fact, this attachment is malicious software that disables antivirus products, attempts to download more malware, and also forwards itself to e-mail addresses saved on the victim's computer.

Malware has become an unsavory part of the World Cup tradition. In 1998, World Cup-themed malware wiped out hard drives and four years later, the VBSChick-F virus tried to take advantage of the World Cup hosted in South Korea and Japan.

Scammers are already looking to score on the next World Cup, telling would-be victims that they've won a lottery connected with the 2010 event, to be held in South Africa, Cluley said.

Widespread interest in any topic creates opportunities for "social engineering" attacks, where people are tricked into helping the attackers, said Cluley. "People are just as hungry to watch the games and get content as they are to get videos of Pamela Anderson or Paris Hilton," he said. "The bad guys have moved from nubile girls to fit young men."

World Cup fans have already seen malware disguised as a downloadable game plan and tickets for this year's event, which is being held in Germany.