Some malware predictions for the next 10 months of 2009.

A little bit late I know ... but it seems that working for a security vendor takes more time than I thought! ;-)

Just to sum it up in a couple of lines, these are a couple of my own predictions:

. Threats on Social-Networking Sites. Cybercriminals no longer deliver threats only via spam. They are taking advantage of Facebook, MySpace, and other popular social-networking sites. I expect this trend to continue throughout 2009, eventually displacing more traditional ways of malware distribution such as email which is already the case today.
. Personalized Threats Speak Your Language. I expect to see the continued expansion of malware in languages other than English like Dutch, etc... Cybercriminals have come to realize that by diversifying into a global market they can access even larger pools of valuable identity and confidential information.
. Malware Targets Consumer Devices. I expect to see increased attacks involving USB sticks and flash-memory devices used in cameras, picture frames, and other consumer electronics. This trend will continue due to the almost unregulated use of flash storage across enterprise environments as well as their popularity among consumers.
. Security Software Scams. The malware underworld is using mainstream practices in an effort to "sell" security software that is either misleading or outright fraudulent. This trend will continue.
. Abusing Free Web-Hosting/Blogging Services. Websites such as Geocities, Blogspot, etc allow anyone to create a public website for free, without the authentication necessary when purchasing a domain-name website. This gives spammers the opportunity to run their underground business with minimal expense. Spam from do-it-yourself social-website-hosting providers arrives at its destination with far greater frequency than links pointing to domain names assigned by legitimate registrars. With little to no threat of punishment for their hosted content, and the new restrictions on short-term domain tasting, the attractiveness of free bandwidth offered by these sites will undoubtedly draw greater focus from malicious parties.
. More Targeted Phishing and Corporate Blackmailing. Botnets via zombie computers, that spread into corporate networks and financial datacenters will increasingly be used to gather sensitive information that can be used for blackmail or sold on the underground market.
. Browser-Based Attacks. Cybercriminals will increasingly attack via web browsers as they are the least-protected and, therefore, easiest way to transfer malware.
. Security Breaches of Confidential Data. Information that is managed by partner and subsidiary companies of bigger companies will be exposed more frequently, forcing an overhaul of data-security practices.
. More Scams Involving Home Businesses. "Legitimate" home business scams generally involve either a pay-up-front and do-it-yourself kit, or a pay-to-play shell game of training and certification. We'll see more of it on television, and the same infrastructure that supports diploma spam and confidence fraud will adjust to the new unemployment reality and will offer people some new bait on the old check-cashing scam.
. Increase in Forging and Abuse of Free Email Services. The free email services have started to allow accounts to send mails with arbitrary "from" addresses. This has increased the usability of these services significantly to businesses, but has also increased the "abusability" by spammers.