A massive malvertising attack is hitting adult content portals, including the top porn domain xHamster.com, which has nearly half a billion monthly visitors.
The malicious ad was instigated by TrafficHaus (since removed), and was for a dating app called “Sex Messenger.” Malwarebytes Labs found that it appeared frequently enough to consistently replicate the infection, and found that this attack, like others like it, infects the user’s system with ransomware via an exploit kit.
Malwarebytes Labs’ research team has identified several large malvertising attacks over the past few months, including those targeting Yahoo! and eBay UK. All of these appear to be connected and caused by the same criminal group.
“The SSL malvertising campaign, which we documented in August affecting Yahoo.com, MSN.com and many other top sites, is still ongoing,” said Malwarebytes researcher Jerome Segura. “What allows us to differentiate [this campaign] from other malvertising attacks are some similar infrastructure patterns, such as the use of the free cloud-based platform provided by Secure Sockets Layer (SSL).” Researchers
have observed that Microsoft Azure and RedHat cloud platforms are used by the threat actors behind the attack, and now, a new platform has been added to the pack. The bad guys are using IBM's Bluemix, looking to take advantage of the free HTTPS encryption it provides when delivering the malicious code.
Segura noted that attack authors are getting smarter: Various checks are built into the advertising to make sure it's a genuine user. Only real users will be able to see the landing page with the exploit kit, so honeypots and security researchers are excluded.
