{
  "family": "skypespam",
  "sample_count": 95,
  "category": "trojan",
  "description": "Worm:Win32/Skypespam is a heuristic classification for worms and trojans that specifically target the Skype messaging platform to aggressively self-replicate by sending malicious links to all contacts in the victim's address book.<br><br><b>Understanding Skypespam</b><br>To the victim, a Skypespam infection results in their Skype account rapidly sending out messages containing deceptive links (e.g., 'lol is this you in this video? [link]') to their friends and colleagues. For incident responders, it is a localized worm that leverages social engineering and the implied trust of instant messaging to achieve high infection rates.<br><br><b>Execution and Evasion Strategies</b><br>The infection cycle begins when a user clicks a malicious link received via Skype. The link typically leads to a compromised website that downloads a dropper payload (often disguised as an image or video codec). Upon execution, the malware utilizes the Skype Desktop API (or injects into the `skype.exe` process) to programmatically access the user's contact list and send the localized spam message. The malware establishes persistence via Registry Run keys and frequently downloads secondary payloads, such as cryptocurrency miners or infostealers, to monetize the infected host.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is rapid lateral movement (socially), reputational damage, and the execution of secondary payloads. Threat hunters will observe anomalous child processes spawned by `skype.exe`. EDR platforms frequently flag Skypespam for its aggressive API hooking or process injection targeting the messaging client. Network logs will show the endpoint reaching out to known malicious URL shorteners or compromised domains to download the secondary payloads.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1055",
    "T1566.002",
    "T1105",
    "T1204.002",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1566.002",
      "name": "Phishing: Spearphishing Link",
      "tactic": "Initial Access"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint to halt the active spam campaign and prevent the downloading of further secondary payloads.",
    "Advise the victim to immediately change their Skype password and enable Multi-Factor Authentication (MFA).",
    "Utilize EDR to identify and terminate the specific malicious process hooking into the Skype API.",
    "Perform a full forensic sweep to identify and remove the core worm executable and any secondary payloads (like miners) it downloaded."
  ],
  "what_to_avoid": [
    "Do not ignore the infection as a 'low severity' spam issue; the worm frequently downloads high-severity trojans as secondary payloads.",
    "Avoid relying solely on automated AV removal; ensure the user's Skype account credentials are changed to prevent cloud-based account hijacking."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}