{
  "family": "yahlover",
  "sample_count": 7,
  "category": "advanced_threat",
  "description": "Worm:Win32/Yahlover (also known as the **Yahoo Messenger Worm**) is a prolific mass-mailing and instant messaging worm that aggressively spread by hijacking Yahoo Messenger accounts to blast malicious links to the victim's entire contact list. Beyond its massive propagation capabilities, Yahlover is highly destructive, acting as a file infector (`.exe` and `.dll` files) and aggressively disabling endpoint security software.<br><br><b>Understanding the Yahlover Worm</b><br>To an infected user, the computer might become unstable, and their friends would complain about receiving strange links via Yahoo Messenger. For security analysts, Yahlover represents a severe, dual-threat incident. It acts as an aggressive network worm causing massive congestion, and simultaneously acts as a file infector, meaning simply deleting the worm executable is not enough to remediate the endpoint, as legitimate system files have been structurally altered.<br><br><b>Propagation and File Infection Mechanics</b><br>The infection cycle begins when a victim clicks a malicious link received via Instant Messenger (`T1534`) or opens an infected email attachment. Upon execution (`T1204.002`), Yahlover establishes persistence via multiple Registry Run keys (`T1547.001`). Its primary propagation mechanism is hijacking the active Yahoo Messenger session to send messages containing a link to a copy of itself to all online contacts. Concurrently, it acts as a File Infector (`T1055.001` - logic injection), searching the hard drive for executable files (`.exe`, `.scr`, `.pif`) and physically appending its malicious code to the legitimate binaries. Furthermore, Yahlover aggressively terminates processes and deletes registry keys associated with hundreds of popular antivirus and firewall products (`T1562.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the hijacking of communication platforms, the corruption of legitimate executables, and the disabling of endpoint security. The most glaring IoC is an overwhelming surge in outbound IM traffic or automated messages originating from the user's account. Host-based IoCs include EDR alerts for the sudden, forceful termination of antivirus processes and the modification (file size changes and hash changes) of hundreds of legitimate `.exe` files across the `C:\\` drive.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1534",
    "T1562.001",
    "T1055.001",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1534",
      "name": "Internal Spearphishing (Propagating via Instant Messenger)",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1055.001",
      "name": "Process Injection: Dynamic-link Library Injection (File Infection logic)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Killing AV processes)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint from the network immediately to halt the IM propagation engine and stop it from spamming contacts.",
    "Ensure the endpoint's antivirus is actually running, as Yahlover explicitly targets and disables security software.",
    "Because Yahlover is a file infector, standard manual deletion will not work. You must use an enterprise antivirus solution capable of 'cleaning' (disinfecting) the appended malicious code from legitimate `.exe` files.",
    "If disinfection fails or the system is heavily corrupted, a complete OS rebuild from secure backups is required."
  ],
  "what_to_avoid": [
    "Do not trust messages containing links sent via IM from infected users, even if they are known contacts.",
    "Avoid assuming the threat is remediated by deleting the initial dropped file; the file infector component has likely already compromised dozens of legitimate system files."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}