Fireball: Security researchers have discovered a new massive malware campaign that has already infected more than 250 million computers worldwide, both Windows and Mac OS.
The malware is called Fireball and is an adware package that takes full control of a victim's browsers by turning them into zombies. This allows attackers to spy on the victim's web traffic and potentially steal their data.
Check Point researchers, who discovered this massive malware campaign, linked the operation to Rafotech, a Chinese company that claims to offer digital marketing and gaming apps to 300 million customers.
The company is currently using Fireball to generate revenue by injecting ads into browsers. This malware can quickly mutate and cause a massive disaster with major cyber incidents worldwide.
Fireball comes bundled with other free software programs that you download from the Internet. Once installed, the malware installs plugins on your browser to control it. It immediately starts by replacing your default search engine and homepage with fake ones like trotux[dot]com.
“It is important to remember that when a user installs freeware, it does not necessarily mean that they are installing additional malware at the same time,” the researchers say. “It is possible that Rafotech uses additional distribution methods, such as distributing freeware under fake names, or spam.”
The fake search engine simply redirects the victim's queries to either Yahoo.com or Google.com and includes tracking pixels that collect the victim's information.
Fireball is not legitimate and can spy on the victim's web traffic. It can execute any malicious code on infected computers, install plug-ins, or even execute efficient malware that creates huge security gaps in targeted systems and networks.
“From a technical point of view, Fireball displays excellent concealment techniques and qualitative evasion of detection capabilities, a multi-layered structure, and flexible communication with C&C, just like a typical malware,” the researchers report.
The Fireball adware hijacks users' web traffic to boost its owners' advertising revenue, but at the same time it also has the ability to distribute additional malware.
“Based on the estimated infection rate, one in five companies worldwide is vulnerable to a major breach,” the researchers added.
