Malware designed to steal users' Windows Live Messenger password has been released onto the net. The password stealer was released for download via BitTorrent earlier this week by a hacker using the handle "Our Godfather".

The malware comes in the form of an IMB download confirmed by anti-virus firm Sophos as containing a password-stealing Trojan horse. Victims would need to be tricked into downloading and executing the malware, which might be renamed in a bid to disguise its identity, in order for the exploit to work.

Sophos has named the malware as MSNfake-M and added protection against the code to its security software packages. Other anti-virus firms can be expected to follow suit.

In the past, hackers have distributed malware that posed as the latest version of Windows Messenger. Occasionally, they've also crafted Trojan apps designed to pinch Windows Messenger (or other IM client) login credentials, though the passwords and usernames attached to online banking and gaming accounts are a far more frequent target of attack.

Standard defensive precautions against viral attacks apply in defending against the latest Trojan.

Users are urged to keep patch systems up to date and update anti-virus signature definition files. Resisting the temptation to open unsolicited files is also a good idea, of course. ®

Related stories

• Russians crack OpenOffice security (20 April 2007)
• Demo neuters antiphishing measure (12 April 2007)
• Exploit for latest Windows vuln already animated (30 March 2007)
• Comment Fear and Loafing at RSA (9 February 2007)
• Yorkshire website to aid SMEs in phish fight (8 February 2007)
• Updated MySpace slams ad networks over 'scareware' (24 January 2007)
• Yahoo! Messenger! in! security! flap! (18 December 2006)
• Virus poses as MSN Messenger 8 (28 December 2005)
• AOL IM worm roots around Windows PCs (31 October 2005)
• IM worm hits Reuters (15 April 2005)