Thousands Scammed by Online Ads

SecureWorks reports: Hackers scam thousands of PC users through online ads touting rogue antispyware

Dark Reading Staff, Dark Reading

November 7, 2007

2 Min Read

ATLANTA -- SecureWorks reported today that hackers using Russian Business Network (RBN) services, among other hosting services, have successfully scammed thousands of victims with a new and complex multi-step scam involving rogue antispyware. Reported incidents of the scam have increased 1000 percent in the last month. Complaints of the scam can be found on sites, such as castlecops,

How the Hacker Scam Works

  • 1) Victim browses a legitimate, high-traffic website where a legitimate-appearing ad is hosted

    2) Victim clicks on the page or takes some other action on the page and this initiates a pop-up warning about a suspicious problem on the victim's computer.

    3) The pop-up in the previous step starts a "sales process" where a bogus anti-spyware solution is offered and sold to the victim for amounts ranging from $19.95 to $79.95 in exchange for credit card info, etc. Bogus antispyware names used in this offer include: Spy-shredder, AntiVirGear, MalwareAlarm and 40 other more obscure names.

    4) The "antispyware solution" purchased either downloads a trojan, such as Zlob, that retrieves other information from the victim over time or a rootkit, allowing remote control of the victim's computer.

    6) The scammer behind the bogus antispyware solution makes money from the sale of the "solution" but is mostly interested in selling the credit card numbers for money and selling access to the trojan and rootkit infected computers. Once access to the infected computers is purchased, the criminals can mine the stolen data and commit the fraud themselves or sell it to a third party. The scammers are also selling computing resources for money.

The new scam is dependent on a high degree of collaboration among a number of Internet criminals for the full "supply chain" to benefit to the greatest possible extent from the scam. The hackers behind the “badvertising” scam are randomly injecting the ads with the malicious code, making it very difficult for the website owner to predict which ads are malicious and which ads are safe.

SecureWorks Inc.

About the Author(s)

Dark Reading Staff

Dark Reading

Dark Reading is a leading cybersecurity media site.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like

More Insights