Skype hit by T9000 malware threat that can record video and text chats

Palo Alto Networks uncovers new security threat to Microsoft's Skype service

A new Trojan dubbed T9000 that can record video calls, audio calls and chat messages on Skype has been uncovered by researchers at Palo Alto Networks.

The security company said that the threat is a new type of backdoor malware that can evade detection by many popular anti-virus systems, including some big names such as Kaspersky and Panda.

The full list from Palo Alto of security firms' software it can dodge is: Sophos, INCAInternet, DoctorWeb, Baidu, Comodo, TrustPort, GData, AVG, BitDefender, VirusChaser, McAfee, Panda, Trend Micro, Kingsoft, Norton, Micropoint, Filseclab, AhnLab, JiangMin, Tencent, Avira, Kaspersky, Rising and Qihoo 360.

T9000 is a new variant of T5000, which was first spotted in 2013. The payload is hidden inside phishing emails with an infected .rtf document, but is sophisticated enough to get in through other means, when its controllers have the will.

Once installed, the software can record Skype calls and upload them along with text chats to a server. It can also take regular screenshots. The only saving grace is that a user has to give it permission, albeit unwittingly - an API request asking for permission for explorer.exe to access Skype appears. In reality this should never be needed so it should be quite clear that it's dodgy.

The researchers explained: "The victim must explicitly allow the malware to access Skype for this particular functionality to work. However, since a legitimate process is requesting access, the user may allow this access without realising what is actually happening. Once enabled, the malware will record video calls, audio calls and chat messages."

A computer with granted permissions could also have documents stolen, including on removable drives.

Skype is used more and more by businesses as part of the Office suite, so there is the potential for hackers to uncover potentially lucrative information.

Palo Alto has published a list of indicators that your machine is infected, as the sheer complexity and audacity of T9000 means that prevention is more or less the only form of protection at the moment.

Meanwhile, Microsoft has said that it protects users from the malware with security updates. "To further protect our customers, we've added detection for the malicious software known as T9000 to Windows Defender," the company said.

"Customers that have installed security updates released in 2012 (MS12-060) and 2014 (MS14-033), either manually or by enabling automatic updates, will already be protected. Our recommendation is to enable automatic updates, which installs the latest security protections, and to use the latest version of Skype."