Rogue ads infiltrate Expedia and Rhapsody sites.
Following on from last month’s feature on the SWF.AdHijack family (see
VB, January 2008, p.12
), malicious
Flash
ads were found to have made their way into popular travel site Expedia.com and music download site Rhapsody.com.
According to
Trend Micro
researchers, the
Expedia
site was infiltrated by a variant of the SWF.AdHijack family – clicking on the ad led to a number of redirections, which eventually resulted in the installation of a piece of rogue anti-spyware detected by
Trend
as TROJ_GIDA.A.
The malicious ad found on the
Rhapsody
site similarly redirected users to a page that attempted to install a bogus program on the user’s machine by reporting a (non-existent) system infection, and then urging them to purchase the software needed to ‘clean’ the infections.
Investigators estimate that the ads were active on the
Rhapsody
site for six days before being removed. According to
Expedia
an ‘imposter advertiser’ managed to circumvent the company’s advertising policy. At the time of writing the company didn’t know how long the ad had been active.
Posted on 01 February 2008 by
Virus Bulletin
Leave a Reply