Security News Chrome Users Targeted with Malware via New "Font Wasn't Found" Technique

[LASER_oneXM]

... some quotes from the article above:

Google Chrome users need to be on the lookout for websites trying to trick them into downloading a font update package for their browser, as most chances are that the file is laced with malware.

This infection technique was discovered by Proofpoint researchers, who say that only Chrome users on Windows are targeted, only from specific countries, and only if they navigated to a compromised website using a specific route (referrer), such as search engine results.

Chrome users infected with Fleercivet click-fraud malware

These recent "font wasn't found" attacks on Chrome users are different because they rely on users clicking a download button, something that doesn't guarantee the same high level of successful infections that exploit kits assure.
Proofpoint says that the font update packages that users download via this technique are infected with the Fleercivet click-fraud malware, which works by navigating to preset URLs and clicking on hidden ads behind the user's back, earning crooks money.
This same malware was advertised on underground cybercrime services under the name of Simby in early 2015, and Clicool in late 2015 and in 2016.

 

[Parsh]

Has less methodological chances (scope wise) of infection of course but the message may sound somewhat trustworthy for some users when visiting new/unknown sites, as one can relate it to 'font missing/ not found' issue they face in other apps like Office suites.
Yet, such suspiciously offered downloads should be enough alert for the user!
Either deep technology or psychology of fear and wanting will always be exploited like this.

 

[Ink]

New techniques, old tricks to get users to install some Chrome_Font.exe.

Google Chrome users, I advise not to disable Safe Browsing as this WILL protect you many a time.

Find out more about Safe Browsing by Google | Link

I usually download fonts as either .TTF or .OTF for Windows, not an .EXE.

 

[Ink]

Surprised to see this posted in MRA (Accidentally installed Chrome_Font.exe and cant install most removal programs like Malwarebytes, etc) following my previous post. @AnakinSkywalker does Chrome not show you warnings about unsafe downloads? What made you click to run the file?