FormSpy Trojan Horse Installed as NumberedLinks Firefox Extension

Another virus is infecting computers and it is disguising itself as a mozilla firefox extension this time. The virus is a trojan horse named Formspy and can be found as the NumberedLinks Firefox Extension is your browser.

Top antivirus software provider McAfee profiles Formspy

“This is a detection for a malware that is installed as a Mozilla/Firefox component extension.

Upon execution, it registers Mozilla event listeners to the malware and sends information submitted by the victim in the web browser to a malicious website. These information can include, but is not limited to, credit numbers, passwords, e-banking pin numbers etc. The main executable is also capable of sniffing passwords from ICQ, FTP, IMAP and POP3 traffic.

This malware was modified from the “NumberedLinks 0.9″ which is an open source Mozilla component available off the Internet. To the victim, he or she would only notice the “NumberedLinks 0.9″ extension being installed via the Mozilla graphical user interface.

Discovered from the wild, this malware was downloaded and installed by the Downloader-AXM trojan.”

In more simpler words, Mozillazine says that the trojan pretends to be the legitimate numberedlinks extension. They say FormSpy trojan does not use any Firefox security flaws to infect computers, but is is downloaded and installed automatically by a piece of Windows malware known as Downloader-AXM. They advise Firefox users to check their installed extensions and the unexpected presence of “Numbered Links 0.9″ indicates a possible infection.

Numberedlinks is a cool firefox extension that allows web navigation via unique numbers next to links, buttons, and other elements which lets you browse the web without a mouse, especially together with mozless or other keybinding extensions.