Google Adwords Malvertising Campaign Targets Apple Macs

Cheeky attackers make their lure an ad for Google Chrome.

Apple Mac owners using the Google search engine may have been infected via malicious ads at the tip-top of their search results last week after attackers launched a malvertising campaign against Google Adwords. In an act of gumption or plain cheek, the attackers malicious lure of choice was a phony ad for one of Googles own products, Google Chrome.
I didnt think anyone had the guts to squat on Googles own page, says Cylance security researcher Jeffrey Tang, who
discovered the attack
while seeking a Chrome downloader for his girlfriend.
Similar to a campaign discovered by Malwarebytes last year, the malvertisers in this attack legitimately paid to bid on popular keywords to so that their ads would appear at the top of the search engine results page when those keywords were used. The campaign found last year used youtube. This one used the words google chrome.
Tang did the search, saw the ad for Chrome, and clicked on it - which he confesses was mindless, but he had no indication there was something strange.
The ad itself showed a display URL of www.google.com/chrome. The URL displayed in the lower right-hand corner when scrolling over the link showed the same legitimate-looking display URL.
Yet, as Tang describes in a blog today: clicking on the ad takes a user to www(dot)entrack(dot)space and then redirects the user to googlechromelive(dot)com – a page offering a free download of Google Chrome.
Tang spotted this as totally not a legitimate page. He found a safe place to download Chrome for his girlfriend, then did more digging.

Black Hat Europe 2016 is coming to Londons Business Design Centre November 1 through 4. Click for information on the
briefing schedule
and
to register.

The Chrome download link will redirect Windows users to a page that delivers an error message that claims there is a DNS failure. Mac users, however, are redirected through a variety of other domains and ultimately infected with a malicious installer for OSX: OSX/InstallMiez, a.k.a. OSX/InstallCore. As Tang explains on his blog today:
...the malicious download link redirects macOS users through ttb(dot)mysofteir(dot)com, servextrx(dot)com, and www(dot)bundlesconceptssend(dot)com then ultimately downloads a malicious file named FLVPlayer.dmg. The malware hash changes on each download, making it difficult to detect and track.
... Once the installation [of FLV Player] is completed, the browser is redirected to a scareware page at ic-dc(dot)guardtowerstag(dot)com. Clicking on the link takes the user to macpurifier(dot)com – a potentially unwanted program (PUP) claiming to cleanup OS X computers.
Tang describes the attackers as middlemen, installing someone elses malware and paid per install. The fact that the malvertisers have targeted Mac is a sign that attackers have recognized Apples market share is growing, Tang notes.
But its also possible that the campaign could have been planned for PCs as well. The fact that Windows users are redirected to a page that returns an error message could mean either theres a misconfiguration or its not set up yet, he says. Id like to think theyre equal opportunity malvertisers, he added, wryly.
The campaign might have been stopped from the beginning, however, if there had been a more rigorous verification process when creating the ad. If Google AdWords and other ad networks verified that an ad re-directed to the same URL it displayed, it could prevent malvertising threats like this.
He acknowledges that there is a massive scalability challenge if ad networks need to do this verification with a manual process, but says that he thinks its ridiculous that at least the primary domain isnt matched.
It blows my mind, says Tang, that here we are, its 2016, and were still allowing this mischievous behavior.
Related Content:
Ciscos Talos Group Shuts Down Malvertising Campaign
Malvertising Campaign Rages Undetected For 3 Weeks

Last News
▸ Nigerian scammers now turning into mediocre malware pushers. ◂ Discovered: 23/12/2024 Category: security	▸ Beware EMV may not fully protect against skilled thieves. ◂ Discovered: 23/12/2024 Category: security	▸ Hack Your Hotel Room ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Google Adwords Malvertising Campaign Targets Apple Macs