One of the most common tactics used by notorious cybercriminals is to capitalize on popular trends and create fake websites/apps to mislead users. And now it seems that some hackers have tried to exploit the confusion surrounding the Meltdown and Spectre CPU vulnerabilities.
Forget the updates that are causing numerous problems for users, Malwarebytes has identified a fake update package that installs malware on your computer. The company has identified a new website that is full of material about how Meltdown and Spectre affect CPUs.
The website appears to have content from the German Federal Office for Information Security (BSI). However, the website is fake and hosts a link to a ZIP archive, which is a piece of malware. The fake file is Intel-AMD-SecurityPatch-10-1-v1.exe.
If the user downloads the file and attempts to install it, the Smoke Loader malware infects their computer. It then downloads more payloads, connecting to various domains and sending encrypted traffic.
The website was also found to be sending fake “phishing” emails.
Malwarebytes has already contacted CloudFlare and Comodo about this abuse, and the site is no longer operational. But that doesn't mean hackers aren't trying to exploit such published events.
End users are advised to always remain cautious and receive updates from trusted sources only. In case you receive direct emails or calls from vendors, be very cautious.
