Cisco announced that malicious ads have been posted on websites including YouTube, Amazon and Yahoo, part of a sophisticated campaign to spread malware.
As security researcher Armin Pelkmann reports, when a user clicks on the malicious ads, they are redirected to a different website, which triggers a download based on whether the computer is running Windows or Apple's OS X.
The network has been nicknamed “Kyle and Stan” because of the names that appear in subdomains on over 700 websites created by the attackers to distribute the malware. Pelkmann wrote. “The large number of domains allows attackers to use a particular domain for a very short period of time, burn it down, and move on to using another one for future attacks. This helps to avoid reputation security solutions and blacklisting.”
