Microsoft warns of ad-scamming, credential-stealing malware hitting multiple browsers

guest · Dec 10, 2020

Microsoft warns of ad-scamming, credential-stealing malware hitting Edge, Chrome, Firefox, Yandex browsers
December 10, 2020
https://www.theregister.com/2020/12/10/adscamming_credentialstealing_malware/

On Thursday Microsoft warned that there's an ongoing campaign to distribute malware that modifies web browsers to conduct credential theft and ad fraud.

Since at least May, 2020, unidentified cybercriminals have been distributing a family of browser modifiers dubbed Adrozek, Microsoft said. The code, which targets Google Chrome, Microsoft Edge, Mozilla Firefox, and Yandex Browser on Windows, mainly injects ads into search results pages.

"If not detected and blocked, Adrozek adds browser extensions, modifies a specific DLL per target browser, and changes browser settings to insert additional, unauthorized ads into web pages, often on top of legitimate ads from search engines," the Microsoft 365 Defender Research Team said its blog post.
"The intended effect is for users, searching for certain keywords, to inadvertently click on these malware-inserted ads, which lead to affiliated pages."
Click to expand...

Microsoft: Widespread malware campaign seeks to silently inject ads into search results, affects multiple browsers

A persistent malware campaign has been actively distributing an evolved browser modifier malware at scale since at least May 2020. At its peak in August, the threat was observed on over 30,000 devices every day. The malware is designed to inject ads into search engine results pages. The threat affects multiple browsers—Microsoft Edge, Google Chrome, Yandex Browser, and Mozilla Firefox—exposing the attackers’ intent to reach as many Internet users as possible.

We call this family of browser modifiers Adrozek. If not detected and blocked, Adrozek adds browser extensions, modifies a specific DLL per target browser, and changes browser settings to insert additional, unauthorized ads into web pages, often on top of legitimate ads from search engines.
Click to expand...

Ad injection
After tampering with multiple browser components and settings, the malware gains the capability to inject ads on search results on affected browsers. The injection of ads is performed by malicious scripts downloaded from remote servers.
Credential theft
On Mozilla Firefox, Adrozek takes things further. It makes the most of its foothold by performing credential theft. It downloads an additional randomly named .exe file, which collects device information and the currently active username. It sends this information to the attacker.
Click to expand...

guest · Dec 12, 2020

CERT-In Virus Alert
Adrozek Malware
Virus Type: Browser Modifiers
December 11, 2020
https://cert-in.org.in/s2cMainServlet?pageid=PUBVA01&VACODE=CIVA-2020-1853

It has been reported that a new malware named Adrozek is affecting user's device globally. It infects the device and then proceeds to modify web browsers and their settings in order to inject ads into search results pages.
Infection Mechanism:
The malware is distributed via classic drive-by download schemes. Users are typically redirected from legitimate sites to shady domains where they are tricked into installing malicious software. The software installs the Adrozek malware, which then proceeds to obtain reboot persistence with the help of a registry key. [...]
Click to expand...

Log in or Sign up

Microsoft warns of ad-scamming, credential-stealing malware hitting multiple browsers

guest Guest

guest Guest

Log in or Sign up

Microsoft warns of ad-scamming, credential-stealing malware hitting multiple browsers

guest Guest

guest Guest

Useful Searches