Data443 & Cyren
Products
- - - Products
    - For OEMs
    - Malware Detection
    - Malware Analysis
    - URL Categorization
    - Email Security
    - Threat Intelligence
    - For Enterprises
    - Malware Analysis
    - Inbox Security for Office 365
    - Threat Intelligence
  - - In the News
      
      Online Businesses Become a Phisher’s Playground
      Not nearly enough businesses have deployed sufficient security measures against phishing attacks through website builders and CMS platforms.Read Article on DarkReading >
      
      Go to Newsroom >
Solutions
- - - Expert Support
      
      Cyren’s dedicated security analysts have the expertise to deeply investigate sophisticated threats – their embedded documents and messy code.
      
      And from their vantage point across companies, geographies, and industries, analysts can track emerging attack vectors and prevent breaches.
      
      “For any false positive or user reported items, we do not need to be involved. Cyren’s dedicated team is on top of all these items.”
      
      via Gartner Peer Insights
Resources
- - - Recent Posts
      - Analyzing behavior to protect against BEC attacks December 22, 2022
      - Using NLP techniques to protect against BEC attacks December 8, 2022
      - Phishing with QR codes December 1, 2022
Company
- - - Company
    - About Cyren
    - Careers
    - Management
    - In the News
    - Contact Us
  - - In the News
      
      Online Businesses Become a Phisher’s Playground
      Not nearly enough businesses have deployed sufficient security measures against phishing attacks through website builders and CMS platforms.Read Article on DarkReading >
      
      Go to Newsroom >
BOOK A DEMO

Select Page

Cyren Security Blog

The Cyren Security Blog is where Cyren engineers and thought leaders provide insights, research and analysis on a range of current cybersecurity topics.

Pacquiao-Margarito Fight KOs users with Fake AV

November 13, 2011, Saturday – The world will once again witness two of world boxing’s greatest fighters trading punches in the ring to see who’s the toughest and who will be win the WBC Super Welterweight World Title. For those of you who are not boxing aficionados, more info about Pacquiao (winner of 8 major world titles and named as the Fighter of the Decade for years 2000-2009 by the Boxing Writers Association of America) is available here

Peddlers of Fake AV once again see this as a good opportunity to infect computers over the internet via Search Engine Optimization (SEO) poisoning attacks. The infection delivers fake system alerts designed to fool users into buying fake antivirus products (providing a neat source of income to Fake AV gangs).

Searching for the keywords “Pacquiao-Margarito Fight” on Google gives the following results:

The link redirects differently depending on the Web browser type as well as operating system. If you’re using a web browser other than Internet Explorer or Firefox for Windows then you’ll be redirected to the site “hxxp://adobefeatures .CC” which shows the fake Adobe Flash Player update seen below:

Clicking any button will result in the page insisting you download and install the fake Flash Player update named “v11_flash_AV.exe”. This malicious file is detected by Commtouch’s Command Antivirus as W32/FakeAV.BAU.

Users of Firefox will be redirected to the site “hxxp://lazyfirefox .CC” which is temporarily unavailable as of this writing.

Users of Internet Explorer will be redirected to pages with fake system messages such as these:

Clicking any button will still take users to fake scanning pages – a common method used by fake antivirus to force users to download and execute various malicious files. Fake scan results are shown below:

The Command antivirus detects the downloaded file “inst.exe” as W32/FakeAV.BAV

Lastly, I will add that MAC or LINUX users are lucky since they only get redirected to the site “feeds.feedburner.com/goodnewspic” which has no malicious content.

Enjoy the fight!

Nov 12, 2010 | Security Research & Analysis

Categories

You might also like

Analyzing behavior to protect against BEC attacks

Business Email Compromise

Understanding “normal” behaviors in email exchanges are key to combating advanced phishing and BEC attacks by John Stevenson Detecting Business Email Compromise (BEC) In the final part of our series of blogs on Business Email Compromise (BEC), it’s time to look at how...

Using NLP techniques to protect against BEC attacks

Business Email Compromise, Office 365, Phishing

How Natural Language Programming help combat phishing and BEC attacks by John Stevenson Business Email Compromise (BEC) Business Email Compromise (BEC) covers a range of email attacks that typically share a common core attribute. There is no obvious executable...

Phishing with QR codes

Phishing, Security Research & Analysis

Don’t Scan or be Scammed By Maharlito Aquino, Kervin Alintanahin and Dexter To In 1994, a type of the matrix barcode known as the Quick Response code, now widely known as QR code, was invented by Masahiro Hara from a Japanese company Denso Wave. The purpose of the...