Reply to thread

Message

<blockquote data-quote="roger_m" data-source="post: 1058463" data-attributes="member: 31436">I wasn&#039;t sure of the best place to post this.The website [PLAIN]ghacks.net[/PLAIN] has either been hacked or, what is more likely, is a victim of a malvertising campaign. If you visit any webpage there, a few seconds after the page loads, the content gets replaced with a fake browser update message, to try and trick the site visitor into downloading an updated version which is actually malware. This is shown in the Chromium based browser I use.[ATTACH=full]278738[/ATTACH]When I visit the site in Edge I get the following.[ATTACH=full]278737[/ATTACH]In both cases, when moving the mouse cursor over the download link, it shows a valid URL for download pages for Chrome or Edge. However if you click on the link, it will download a file named ChromeSetup.exe or MlсrоsоftЕdgеSеtup, from Dropbox, which is malicious. There is also a different fake update page for Firefox and maybe some other browsers too.The malware currently has 35 detections at VirusTotal, with Kaspersky detecting it as Trojan-Downloader.Win64.RustyPita.y.[URL unfurl=&quot;true&quot;]https://www.virustotal.com/gui/file/37bba90d20e429ce3fd56847e4e7aaf83c62fdd70a7dbdcd35b6f2569d47d533?nocache=1[/URL]</blockquote>

[QUOTE="roger_m, post: 1058463, member: 31436"] I wasn't sure of the best place to post this. The website [PLAIN]ghacks.net[/PLAIN] has either been hacked or, what is more likely, is a victim of a malvertising campaign. If you visit any webpage there, a few seconds after the page loads, the content gets replaced with a fake browser update message, to try and trick the site visitor into downloading an updated version which is actually malware. This is shown in the Chromium based browser I use. [ATTACH type="full" width="680px" alt="Fake Chrome Update 1.png"]278738[/ATTACH] When I visit the site in Edge I get the following. [ATTACH type="full" width="680px" alt="Fake Chrome Update 2.png"]278737[/ATTACH] In both cases, when moving the mouse cursor over the download link, it shows a valid URL for download pages for Chrome or Edge. However if you click on the link, it will download a file named ChromeSetup.exe or MlсrоsоftЕdgеSеtup, from Dropbox, which is malicious. There is also a different fake update page for Firefox and maybe some other browsers too. The malware currently has 35 detections at VirusTotal, with Kaspersky detecting it as [B]Trojan-Downloader.Win64.RustyPita.y[/B]. [URL unfurl="true"]https://www.virustotal.com/gui/file/37bba90d20e429ce3fd56847e4e7aaf83c62fdd70a7dbdcd35b6f2569d47d533?nocache=1[/URL] [/QUOTE]

Verification