Click-fraud malware, typically used to artificially inflate advertising revenue, is now being used to promote Russian propaganda on the Dailymotion video site, according to a report published by Trustwave.
According to the report, the malware campaign begins with the Angler exploit kit, which installs the Bedep Trojan on victims' computers. Bedep used for click fraud, said Ziv Mador, VP of security research at Trustwave Holdings, Inc.
Recently, however, it has been used to drive traffic to Dailymotion videos, a video site based in France.
"It automatically loads movies from Dailymotion.com in such a way that the user of the infected terminal cannot see them," Mador said.
This artificially inflates the view counts of videos, making them appear more popular than they actually are — and thus causing them to be placed on the front page of the site.
Mador discovered several videos promoted in this way, each with a very similar view count of around 320,000 views, and identical historical trend charts.
A visible sign that the traffic is fake is that, despite the high view numbers, there was almost no social sharing or comments on these videos.
"Usually when you go to movies that are popular, there are Tweets and Facebook shares," he said.
To some extent, the tactic is working. On Tuesday, one of these pro-Russian videos was the second featured video on the site's home page, according to Mador.
The videos themselves are from third-party sources. A front-page video, for example, titled “Why Ukraine matters to the US & Russia,” is from CNN. But despite receiving more than 340,000 “views,” the video has not received a single Facebook share, Tweet, or comment.
"We believe the vast majority of these views are not real," Mador said.
In contrast, a video from the earthquake in Nepal, with 258,000 views, has almost 700 Facebook shares.
The use of click-fraud malware for political propaganda purposes is something new, according to Mador's statement.
"We believe these hackers are pro-Russian," he said.
The malware is also used for traditional reasons – to generate fake clicks on ads, and to generate fake views for current, non-political videos such as celebrity gossip.
