Partnerstroka: Large tech support scam operation features latest browser locker

guest · Sep 13, 2018

Partnerstroka: Large tech support scam operation features latest browser locker
September 13, 2018
https://blog.malwarebytes.com/cyber...cam-operation-features-latest-browser-locker/

We have been monitoring a particular tech support scam campaign for some time which, like several others, relies on malvertising to redirect users to the well-known browser lockers (browlocks) pages.

However we caught up with the same campaign again recently and noticed that the fake alert pages contained what seemed to be a new browlock technique designed specifically for Google Chrome. In this blog post, we share some of our findings on this group and their latest techniques.
The evil cursor
In early September, we came across the Partnerstroka group again and noticed that they had incorporated a browser locker technique that was working against the latest version of Google Chrome (69.0.3497.81). Similar to other tricks, it effectively prevented from closing the offending page because the mouse cursor had been hijacked. [...]
Click to expand...

xxJackxx · Sep 13, 2018

I've not had a hands on encounter with this but if the mouse is hijacked would ALT + F4 still work?

guest · Nov 5, 2018

Browlock flies under the radar with complete obfuscation
November 5, 2018
https://blog.malwarebytes.com/threa...es-under-the-radar-with-complete-obfuscation/

Not all tech support scam browlocks use obfuscation, but over the years it has become more common to see parts of the code being hidden. What we haven’t really seen is complete encoding of the browlock page such that almost no artifacts are present.
Soup to nuts encoding
We recently came upon a browlock template reported on Reddit that has taken encoding to a whole new level, on top of using the aforementioned unpatched, existing techniques.
There is no denying that crooks are once again trying to play cat and mouse with defenders

For end users, it is important to remember that no matter how scary a warning looks or even sounds, the best course of action is to remain calm and take the time to check on it before overreacting and dialing a scammer’s hot line.

These browlocks are not causing any damage to the computer and can be closed one way or another. The more annoying ones still require using the Task Manager to kill the offending process, which is why we hope browser vendors take these issues seriously to restore power to the user.
Click to expand...

guest · Dec 22, 2018

New Tech Support Scam Causes Chrome Browser to Use 100% of the CPU
December 22, 2018
https://www.bleepingcomputer.com/ne...chrome-browser-to-use-100-percent-of-the-cpu/

This new tech support scam variant was reported in a Google Chrome bug report that states that once a user visits the page, the CPU utilization quickly goes to 100%. This makes it impossible to close the tab, the browser, or properly use the computer until the Chrome process is killed.

This page contains JavaScript that will causes the browser to repeatedly to go to the # URL, followed by the back button to go to the previous page in the browser history, and then the forward button to go back to the original page.
The problem is that once you open Chrome after closing the process, it will prompt you to open the previously opened pages. This will then cause the tech support scam page to reopen, which causes the browser/computer problems again.

In tests by BleepingComputer, this same tech support scam does not affect Firefox. With Firefox, you can simply close the tab and browser to get rid of this Tech Support Scam.
H/T: Jérôme Segura
Click to expand...

guest · Mar 20, 2019

Fake eBay Ad in Google Search Led to Tech Support Scams
March 20, 2019
https://www.bleepingcomputer.com/ne...d-in-google-search-led-to-tech-support-scams/

A fake advertisement in the Google search results has been running for the past week that looked just like a legitimate ad for eBay. When you clicked on it, though, instead of being brought to the auction site you would be shown an incredibly annoying tech support scam that would try to lock up your browser.
Ad campaign was live for at least a week
BleepingComputer was alerted to this advertisements from a security researcher who wished to remain anonymous. The research told BleepingComputer that they had discovered the fake eBay ad last week and reported it to Google on the same day, but the ad continued to be shown in the search results.

When you clicked on it, instead of going to eBay, you would be shuffled through a series of redirects [...] This site is still live and should be avoided.
This tech support scam utilizes a loop that makes it difficult to close and when you attempt to do so, it would open the web page in full screen mode.
Click to expand...

guest · Mar 25, 2019

Google fixes Chrome 'evil cursor' bug abused by tech support scam sites
Evil cursor trick was being abused by Partnerstroka gang to trap users on tech support sites
March 25, 2019
https://www.zdnet.com/article/google-fixes-chrome-evil-cursor-bug-abused-by-tech-support-scam-sites/

The trick was that users would think they'd be clicking where the cursor would appear, but they would actually click in another area of the screen, preventing them from closing popups and browser tabs due to inaccurate clicks. See animated GIF below.
Segura reported this bug to Google last fall, however, patching it wasn't straightforward.

According to this bug report, Chrome will automatically revert the mouse cursor back to the standard OS graphics when hovering over parts of the Chrome browser interface (tab bar, address bar, menus, etc.) but will keep the custom cursor when hovering the page content.
The "evil cursor" fix is currently live for Google Canary users, and is scheduled to land in the Chrome 75 stable branch, to be released later this spring.

In the grand scheme of things, users might consider this fix trivial, but this is actually a very important fix. Tech support scams are a big problem in today's cyber-crime scene, and hundreds of thousands of victims have lost billions of US dollars to these crooks.
Click to expand...

guest · Apr 29, 2019

Tech Support Scam Employs New Trick by Using Iframe to Freeze Browsers
April 29, 2019
https://blog.trendmicro.com/trendla...new-trick-by-using-iframe-to-freeze-browsers/

We discovered a new technical support scam (TSS) campaign that makes use of iframe in combination with basic pop-up authentication to freeze a user’s browser. Since this technique is new and unfamiliar, it can potentially evade detection.
Creating a loop and freezing a browser is a common method used in TSS campaigns.

TSS campaigns bank on the resulting panic caused by a frozen browser, which might push users to immediately act on the presented course of action, which usually involves calling the number on the screen and following whatever the supposed tech support agent might suggest.
Conclusion
Fortunately, the success of TSS attacks largely depends on how users respond to their tricks. As has been highlighted in this new campaign, users can look out for suspicious characteristics of a webpage, such as unfamiliar URLs, pop-ups asking for authentication, or any sort of information and messages that raise panic and alarm.
Users should remember that there are other ways to recover their browser. Users that encounter a similar attack can simply close the browser using Task Manager.
Click to expand...

guest · Jun 25, 2019

Fake Ads that Lock Browsers Target Elders
June 25, 2019
https://www.infosecurity-magazine.com/news/fake-ads-that-lock-browsers-target-1/

A scam that was discovered last month that involved cyber-criminals invading Microsoft Azure Cloud Services reportedly remains ongoing. According to Malwarebytes’ threat intelligence team, the scam has continued but with a new trick: utilizing paid search results.

Instead of targeting victims through false emails claiming to be from Microsoft or Apple, scammers have been buying ads displayed on major internet portals to target an older demographic to drive traffic to decoy blogs that then redirects victims to a browser lock page, according to researchers.

“To support their scheme, the scammers have created a number of food-related blogs. The content appears to be genuine, and there are even some comments on many of the articles,” the researchers wrote.
Scammers tricked users into believing their computers have been compromised via these blogs. As a result, the crooks were able to convince users that they needed expensive but ultimately useless “support packages” in order to clean up their computers.
Click to expand...

Malwarebytes: Recipe for success: tech support scammers zero in via paid search

Log in or Sign up

Partnerstroka: Large tech support scam operation features latest browser locker

guest Guest

xxJackxx Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Partnerstroka: Large tech support scam operation features latest browser locker

guest Guest

xxJackxx Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches