A new cryptomining campaign has been spotted distributing a fake Adobe Flash Player update. While this isn't the first time we've seen malware pretend to be an update for a real program, this one goes the extra mile and actually updates Flash Player to its latest version, so it doesn't look suspicious to the user.
Brad Duncan, a security researcher at Palo Alto, was the one who discovered the malware campaign. What he found was that during the “Flash Player update” a hidden Monero miner was installed, as well as an update of Flash Player from the official Adobe website.
Updating the program played a very important role, as it arouses less suspicion in the user. Duncan reported that visually and functionally the fake installer was almost identical to the genuine Adobe one.
What the user didn't know, however, was that in his attempt to update his programs, his system had been infected. When the miner was running, the processor usage would spike to 100% as it began "mining" the Monero cryptocurrency.
The way Brad Duncan identified that this was not the real update from Adobe was the URL, which contained “flashplayer_down.php?clickid=”, which would not be there if the installer came from Adobe’s website. Many of these files were hosted on Amazon Cloud AWS, so the researcher was unable to determine which site the campaign was “running” from.
Finally, we recommend that you never download program updates from third-party sites. If you visit a site that suggests you update your Flash Player, simply don't do it. You probably won't download what you're looking for.
