Most malicious pages used in spam SEO attacks target Windows users, by showing what looks like a Windows Antivirus screen running, or Internet Explorer with pages displaying fake IE warnings about outdated flash versions or missing video codecs.
But attackers are now disguising their malicious executables as Firefox updates. The malicious pages use the same theme as the official Firefox website - same background, images, etc.
 |
| Malicious page warn about outdated Firefox version |
At the time of writing, the site is not blocked by Google Safe Browsing, and the detection rate of the malicious executable ff-update.exe is very low: only 6 antivirus vendors out of 42 find it to be malicious.
Our new Firefox extension Search Engine Security does protect against this attack and most other spam SEO threats. You can install it by clicking on the image below:
If you use Internet Explorer, you get redirected to a different domain with the "usual" fake AV screen.
 |
| Fake AV page for Internet Explorer users |
Attackers are widening their range of targets, and keep innovating to find more potential victims.
-- Julien
