Vulnerabilitymedium
More fakeAV for MAC. This time it’s massive
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| url | http://kdsqXXXXe.ce.ms/in.cgi?2&seoref=www.google.com¶meter=$keyword&se=$se&ur=1&HTTP_REFERER=http%3A%2F%2FmatcXXXXnt.com.do%2F&default_keyword=default | search engine such as Google as referrer in the parameters: hxxp://kdsqXXXXe.ce.ms/in.cgi?2&seoref=www.google.com¶meter=$keyword&se=$se&ur=1&HTTP_REFERER=http%3A%2F%2FmatcXXXXnt.com.do%2F&default_keyword=default After that you get malicious HTML with obfuscated Javascrip |
From the original article
2 min read at securelist.com
When my colleague Fabio wrote about a Rogueware campaign targeting MAC users, I investigated a bit into the origin of these campaigns. It was interesting how different researchers were getting those samples through searching images on Google. However, different searches always arrive at the same result, leading to the question: How many search terms have been poisoned?
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.