How the Tumblr worm spread so quickly
Although Tumblr is now cleaning-up pages which were affected by today's worm, SophosLabs was able to briefly explore how the infection spread. — It appears that the worm took advantage of Tumblr's reblogging feature, meaning that anyone who was logged …
Context & Ripple Effects
The worm is the latest entry in a recurring lineage of social-platform malware: MySpace saw a worm ride QuickTime across profiles in 2006, and in 2009 The Register flagged a flaw that made Twitter vulnerable to viral attack. What distinguishes this one is the vector — Tumblr's own reblogging mechanic, which turned every logged-in viewer into an unwitting distributor.
The story travelled widely on the day itself, with pickups at Gawker, PC Magazine, The Register, The H Security, Softpedia, TG Daily and Daily Dot — and Gawker's reporting that the hackers behind it claim they warned Tumblr of the vulnerability weeks earlier adds a disclosure dispute to the cleanup.
First-order effects
- Logged-in Tumblr users who viewed an infected post had the payload executed under their session and reblogged it onward, so SophosLabs' analysis shows the platform's core engagement loop doubling as the infection loop while Tumblr cleans affected pages.
Second-order effects
- Every rival running similar one-click resharing — Twitter's retweet above all, given its 2009 exposure — faces pressure to audit how untrusted content executes inside authenticated sessions, not just how it renders.
- The hackers' claim that they notified Tumblr weeks before the outbreak puts Tumblr's vulnerability-handling process on trial alongside the bug itself, a reputational cost separate from the technical fix.
Third-order effects
- If the pattern holds from MySpace through Twitter to Tumblr, social platforms will have to treat their sharing features as permanent attack surface — designing reblog-style mechanics with sandboxed execution rather than patching them after each outbreak.
The trend: Social networks' core virality mechanics keep being repurposed as self-propagating malware vectors, forcing platforms to secure the share button itself rather than just the content it carries.