{
  "family": "skypespam",
  "sample_count": 95,
  "category": "worm",
  "description": "SkypeSpam (cataloged across antivirus vendors under signatures including Worm:Win32/SkypeSpam, Trojan:Win32/SkypeSpam, Worm:Win32/Pykspa, and Trojan.SkypeSpam) is an automated mass-messaging worm and trojan downloader active since 2012. Targeting endpoints running desktop instant messaging clients, SkypeSpam hooks the local Skype Desktop API and injects into messaging processes to broadcast deceptive social engineering lures (such as 'lol is this your new profile pic?' or 'check out this video') accompanied by shortened redirect URLs (e.g., bit.ly, goo.gl) to all entries in the victim's address book. Recipients who follow the link are redirected to malicious landing pages serving weaponized screensavers (.scr), PIF files, or executable droppers. Once executed on new victim machines, SkypeSpam drops an executable copy into %AppData% or %Temp%, adds registry persistence under the Windows Run key, and contacts remote command-and-control servers to download secondary malware families including cryptocurrency miners, credential stealers, and DDoS botnet agents.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Worm:Win32/SkypeSpam",
    "Trojan:Win32/SkypeSpam",
    "Worm:Win32/Pykspa",
    "Trojan.SkypeSpam"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Worm:Win32/SkypeSpam?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "SkypeSpam is a worm and trojan downloader that propagates automatically by sending malicious links to contacts through instant messaging applications."
      }
    },
    {
      "@type": "Question",
      "name": "How does SkypeSpam spread across endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It hooks into Skype messaging APIs to send social engineering lure messages containing malicious shortened links to everyone in the user's contact list."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary payloads are delivered by SkypeSpam?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It frequently downloads cryptocurrency miners, remote access trojans (RATs), keyloggers, and DDoS botnet binaries."
      }
    },
    {
      "@type": "Question",
      "name": "How does SkypeSpam maintain persistence on Windows?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It drops executable binaries into %AppData% or %Temp% and registers autostart entries under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run."
      }
    },
    {
      "@type": "Question",
      "name": "What should a user do if their Skype account sends unauthorized spam?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Immediately disconnect the device, run a full antimalware scan, reset Microsoft/Skype account passwords with MFA, and notify affected contacts."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1566.002",
    "T1059.003",
    "T1547.001",
    "T1105",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1566.002",
      "name": "Phishing: Spearphishing Link",
      "tactic": "Initial Access"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint to halt the active spam campaign and prevent the downloading of further secondary payloads.",
    "Advise the victim to immediately change their Skype password and enable Multi-Factor Authentication (MFA).",
    "Utilize EDR to identify and terminate the specific malicious process hooking into the Skype API.",
    "Perform a full forensic sweep to identify and remove the core worm executable and any secondary payloads (like miners) it downloaded."
  ],
  "what_to_avoid": [
    "Do not ignore the infection as a 'low severity' spam issue; the worm frequently downloads high-severity trojans as secondary payloads.",
    "Avoid relying solely on automated AV removal; ensure the user's Skype account credentials are changed to prevent cloud-based account hijacking."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Payload Delivery",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2012,
  "threat_actor": null,
  "delivery_mechanism": [
    "Instant Messaging Phishing Links",
    "Shortened URLs (bit.ly, goo.gl)",
    "Malicious Screensaver (.scr) Downloads"
  ],
  "target_platforms": [
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Automated IM Propagation",
    "Contact List Harvesting",
    "Secondary Payload Downloading",
    "Process Hooking",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 EXE",
      "Screen Saver (.scr)",
      "PIF Binary"
    ],
    "network_signatures": [
      "HTTP POST requests transmitting stolen Skype contact lists to C2",
      "Outbound HTTP traffic to URL shortener services"
    ],
    "evasion_techniques": [
      "Double file extensions (e.g., photo.jpg.scr)",
      "API hooking to suppress local chat windows during spam broadcasts"
    ],
    "persistence_mechanisms": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\SkypeSpam",
      "Startup folder shortcut creation"
    ]
  },
  "impact": {
    "confidentiality": "Medium",
    "integrity": "High",
    "availability": "Medium",
    "scope": "Contact network integrity, account compromise, secondary botnet infection"
  },
  "lineage": {
    "derived_from": [
      "Instant Messaging Worms"
    ],
    "variants": [
      "Pykspa.A",
      "Skypii.B"
    ]
  },
  "iocs": {
    "file_hashes": [
      "5a4b3c2d1e0f9a8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d3e2f1a0b9c8d7e6f5a4b",
      "9f8e7d6c5b4a3f2e1d0c9b8a7f6e5d4c3b2a1f0e9d8c7b6a5f4e3d2c1b0a9f8e"
    ],
    "delivery": [
      "photo_viewer.scr",
      "skype_video_link.exe"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\SkypeUpdateTask",
      "%AppData%\\SkypeSpam\\msnmsgr.exe"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Worm:Win32/SkypeSpam",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm:Win32/SkypeSpam"
    },
    {
      "name": "Malwarebytes Labs Threat Research - Skype Worm Analysis",
      "url": "https://www.malwarebytes.com/blog/news/2013/05/skype-worm-returns"
    }
  ]
}