Adware, PUPs, and other unwanted extensions are promoted through websites that pretend to be adult websites.
When a user enters these websites and tries to watch a video, a pop-up video player window will appear, asking them to download and install an updated media player in order to view it. However, this media player installs unwanted programs on the user's computer or redirects them to unwanted Chrome extensions.
These fake sites consist of pages that have been automatically generated based on popular keywords concerning famous names, so that they can acquire as many pages as possible in search engines. When a user clicks on these links and tries to play the video, a fake player appears as shown below:
This player program states that an error occurred while playing the video and that the user must download a media player program in order to be able to watch it.
If a user clicks on the message, they will either download an adware installer program or be redirected to another website that promotes unwanted Chrome extensions. One of the promoted extensions contains actions that perform mining in the browser.
These adware installers are presented as free and legitimate programs like AIMP media player or Avast, to appear more trustworthy and trap more users.
Given that these sites are created solely to promote unwanted software to a user and not to actually reproduce a video, they should be avoided. Even more importantly, if you find yourself on a site that tells you that you need to install a piece of software to use it properly, it would be preferable to find another site that does not require such a thing before you use it.
As this tactic is used very often to deceive users into installing malicious software on their computers, it is important to recognize these types of social engineering attacks.
