Zscaler Blog

Get the latest Zscaler blog updates in your inbox

Subscribe
Security Research

SEO Spammers Go After Firefox Users

image
JULIEN SOBRIER
August 02, 2010 - 1 min read

Most malicious pages used in spam SEO attacks target Windows users, by showing what looks like a Windows Antivirus screen running, or Internet Explorer with pages displaying fake IE warnings about outdated flash versions or missing video codecs.

But attackers are now disguising their malicious executables as Firefox updates. The malicious pages use the same theme as the official Firefox website - same background, images, etc.
 

Image
Malicious page warn about outdated Firefox version

At the time of writing, the site is not blocked by Google Safe Browsing, and the detection rate of the malicious executable ff-update.exe is very low: only 6 antivirus vendors out of 42 find it to be malicious.

Our new Firefox extension Search Engine Security does protect against this attack and most other spam SEO threats. You can install it by clicking on the image below:
 

Install Search Engine Security add-on for Firefox 3.x

 


If you use Internet Explorer, you get redirected to a different domain with the "usual" fake AV screen.

 

 

Image
Fake AV page for Internet Explorer users

Attackers are widening their range of targets, and keep innovating to find more potential victims.

-- Julien

 

form submtited
Thank you for reading

Was this post useful?

Get the latest Zscaler blog updates in your inbox

By submitting the form, you are agreeing to our privacy policy.