Security News Beware the Flames: Fireball Is Much More Than Just Adware

[frogboy]

The browser-hijacker called Fireball should be known as malware, not adware, according to Cylance.

The bad code first ignited concern in June, when it was found to have infected more than 250 million computers worldwide, and 20% of corporate networks globally. According to Check Point at the time, it takes over target web browsers, turning them into zombies. And, it seems focused on adware. Fireball manipulates victims’ browsers and turns their default search engines and home pages into fake search engines, which simply redirect the queries to either yahoo.com or Google.com to generate ad revenue. According to Alexa’s web traffic data, 14 of these fake search engines are among the top 10,000 websites, with some of them occasionally reaching the top 1,000. It also installs plug-ins and additional configurations to boost its advertisement activity.

However, according to Cylance, its behavior is also more akin to malware rather than an annoying click-fraud generator.

For one, the installation of the browser hijacker is effectively silent to the typical user. Installing itself without permission or notification to the user is clearly a malicious action, the firm pointed out in an analysis.

Full Article. Beware the Flames: Fireball Is Much More Than Just Adware

 

[Maliek]

"Then there’s the matter of Fireball’s other functionality: It also can be turned into a fully functioning malware downloader, and is capable of executing any code on the victim machines—a capability that Check Point had uncovered at the beginning."

I think we can place FireBall into the malware section