Fraudsters Conducting Malvertising Campaign Via Inactive Domains

guest · Jul 9, 2020

Fraudsters Conducting Malvertising Campaign Via Inactive Domains
July 9, 2020
https://www.infosecurity-magazine.com/news/fraudsters-malvertising-inactive/

A number of inactive websites have been compromised and are redirecting visitors to unwanted URLs, many of which are malicious. This is according to a new study by Kaspersky, which uncovered over 1000 inactive domains that send users to second-hand pages as a way for fraudsters to make money or even infect their device.

Inactive domains are sometimes purchased by a service before being put up for sale on an auction site. Visitors to the inactive website should then be redirected to the auction stub; however, fraudsters are often substituting these stubs for malicious links.
Many of these download the Shlayer Trojan, which installs adware on infected devices and is distributed by webpages with malicious content.
Click to expand...

Kaspersky researchers discovered that there were about 1000 websites for sale on one of the world’s biggest auction platforms, and these redirected visitors to over 2500 unwanted URLs.
It is believed fraudsters are being paid to drive traffic to both the legitimate advertising pages and malicious sites, which is the motivation for the scheme.

Dmitry Kondratyev, junior malware analyst at Kaspersky, commented: “The domains that have these redirects were — at one point — legitimate resources, perhaps those the users frequently visited in the past. There is no way of knowing whether or not they are now transferring visitors to pages that download malware. [...]
Click to expand...

guest · Jul 9, 2020

Recursive malvertising: over one thousand URLs for sale redirect users to blacklisted pages—including malicious ones
July 8, 2020
https://www.kaspersky.com/about/press-releases/2020_recursive-malvertising-over-one-thousand-urls-for-sale-redirect-users-to-pages-from-the-denylist–including-malicious-ones

When companies stop paying for their domain, sometimes they are purchased by a service and posted for sale on an auction site. Those who attempt to visit the inactive website are then redirected to the auction stub where they see that the domain is currently for sale—or at least they should be. However, by substituting the stub with something else—i.e. a malicious link—fraudsters can create a cunning scheme for infecting users or generating profits at the users’ expense.

Between March 2019 and February 2020, 89 percent of these second-stage redirects were to ad-related pages, while 11 percent were malicious: users were either prompted to install malware or download infected MS Office or PDF documents, or the pages themselves contained malicious code.
Click to expand...

One of the malicious pages uncovered, for example, received 600 redirects on average in just ten days—most likely the criminals receive a payment based on the number of visits. In the case of Shlayer, those that distribute the malware received a payment for each installation on a device.
Click to expand...

Kaspersky: Redirect auction

We’ve already looked at links under old YouTube videos or in Wikipedia articles which at some point turned bad and began pointing to partner program pages, phishing sites, or even malware. It was as if the attackers were purposely buying up domains, but such a scenario always seemed to us too complicated. Recently, while examining the behavior of one not-so-new program, we discovered how links get converted into malicious ones.
Click to expand...

Log in or Sign up

Fraudsters Conducting Malvertising Campaign Via Inactive Domains

guest Guest

guest Guest

Log in or Sign up

Fraudsters Conducting Malvertising Campaign Via Inactive Domains

guest Guest

guest Guest

Useful Searches