Zscaler Data Protection Recognized as a 2023 Product of the Year by CRN

Zscaler Blog

Get the latest Zscaler blog updates in your inbox

Security Research

New Fake AV Page Uses Firefox Internals

March 02, 2011 - 1 min read

Most Fake AV pages mimic a Windows Desktop application running. In addition, the Fake AV pages have generally been the same regardless of which browser they are viewed. I recently found a new type of Fake AV page that looks different on each browser. And it also uses internal elements of those browsers.

Internet Explorer version

The version for Internet Explorer looks more like the previous pages I've seen.

Fake AV page for Internet Explorer

The malicious executable InstallInternetDefender_722.exe is detected by only 9.5% of AV!

Virustotal results for malicious executable

Firefox version

The version displayed in Firefox browsers is very interesting. It looks like the security warning Firefox shows for malicious and phishing sites.

Fake AV page for Firefox

The source code of the pages shows that the page is using internal elements of the browser to construct the page:
  • chrome://global/skin/netError.css
  • chrome://global/skin/icons/blacklist_favicon.png
Use of internal Firefox elements

The warning looks very legitimate.

    Chrome version

    Like for Firefox, the Chrome version looks like a legitimate browser warning.

    First warning from the fake AV page
    Fake AV page fro Chrome

    Safari version

    For Safari, only the first popup box is tailored to the browser. The main page is the same as Internet Explorer.

    Fake Av warning for Safari

    Fake AV continues to evolve. This new version for Firefox will surely fool more than one user.

    -- Julien

    form submtited
    Thank you for reading

    Was this post useful?

    Explore more Zscaler blogs

    A cyber criminal shopping for malware
    Agniane Stealer: Dark Web’s Crypto Threat
    Read Post
    Business people walking through a city
    The Impact of the SEC’s New Cybersecurity Policies
    Read Post
    Digital cloud illuminated in blue
    Security Advisory: Remote Code Execution Vulnerability (CVE-2023-3519)
    Read Post
    TOITOIN Trojan
    The TOITOIN Trojan: Analyzing a New Multi-Stage Attack Targeting LATAM Region
    Read Post
    01 / 02
    dots pattern

    Get the latest Zscaler blog updates in your inbox

    By submitting the form, you are agreeing to our privacy policy.