A new JavaScript worm targeting Yahoo!’s email program has been found in the wild by Symantec Security Response today.

Symantec said the worm, JS.Yamanner@m, spreads itself to a user’s Yahoo! email contacts when the user opens an email infected by the worm. JS.Yamanner sends these email addresses to a remote server on the Internet.

“This worm is a twist on the traditional mass-mailing worms that we have seen in recent years. Unlike its predecessors, which would require the user to open an attachment in order to launch and propagate, JS.Yamanner makes use of a previously-unknown security hole in the Yahoo! Web mail program in order to spread to other Yahoo! users and harvests user information for possible future attacks,” said Symantec Security Response Director, Dave Cole. 

Only those using contacts with an email address that is @yahoo.com or @yahoogroups.com are affected by the worm. Yahoo! Mail Beta users are not vulnerable to JS.Yamanner.

A message from JS.Yamanner can be distinguished by the following:
From: av3@yahoo.com
Subject: New Graphic Site
Body: this is test.

Also, if users open an infected email, their browser window is re-directed to display the Web page with URL: www.av3.net/index.htm.

JS.Yamanner is currently categorised as a Level 2 (out of five) threat by Symantec Security Response.

The company said that since a Yahoo! patch is unavailable, updating anti-virus definitions and deleting any emails received from av3@yahoo.com is highly recommended.

See: http://securityresponse.symantec.com/

728x90 3 Yahoo! Email Worm Emerges
1 Yahoo! Email Worm Emerges
Leaderboard 728x90 Yahoo! Email Worm Emerges
CUST Retention FY22 Sport WinterCodes Q3 NRL 728x90 Yahoo! Email Worm Emerges
Leaderboard 728x90 Yahoo! Email Worm Emerges
211112 4Square Banner Narrow TWE3B 2 Yahoo! Email Worm Emerges
220524 SAV 4square May leaderboard Yahoo! Email Worm Emerges
4Square clarity ad 1 Yahoo! Email Worm Emerges
Suunto 728X90 Yahoo! Email Worm Emerges
gtv r3 728x90 px Yahoo! Email Worm Emerges