Kaspersky Labs has detected Cabir (also known as EPOC.Cabir), the first network worm for mobile phones. Cabir infects telephones running Symbian OS (used by many Nokia telephones). It is thought that the "29a" group of virus writers, who specialise in creating "proof-of-concept" viruses, created the worm.
Detection of Cabir for F-Secure Anti-Virus for Symbian series 60 has been published at 11:55 on June 15th, 2004 in database build number 7.
Cabir is transmitted as a Symbian distribution file, but the file is disguised as Caribe Security Manager utility, part of the telephone security software. If the infected file is launched, the telephone screen will display the inscription "Caribe". Once the worm has penetrated the system it will be activated each time the phone is started. Cabir scans for all accessible phones using Bluetooth technology, and sends a copy of itself to the first one found. Symantec reports that this constant scanning for Bluetooth devices quickly drains the batteries of the infected phone.