A notorious malvertising actor known as ScamClub has infected some of the most widely visited news sites with a bevy of fake McAfee virus alerts, according to new research from Malwarebytes.
In a blog post Thursday, the antimalware vendor detailed how ScamClub’s latest malvertising campaign has spread to mobile news sites for companies such as the Associated Press, ESPN and CBS. The campaign redirects visitors from those mobile news sites to fake virus alerts delivered by “a malicious McAfee affiliate.”
Malvertising schemes typically involve threat actors masquerading as legitimate advertisers or marketing affiliates, then using commercial ad networks and platforms to serve malicious ads or redirect users to attacker-controlled domains. In this campaign, the unidentified affiliate directs users to a fake McAfee antivirus scanner — which is a type of scareware — hosted at the domain systemmeasures[.]life.
Malwarebytes noted in the blog post that Mastodon user Blair Strater spotted the campaign earlier this month while on the Associated Press’ AP News mobile site. Strater was redirected from the site to the fake McAfee antivirus scanner, and on some occasions, he was eventually forwarded to an authentic McAfee checkout page. In a follow-up post, he speculated that the threat actor behind the domain was part of McAfee’s affiliate program, “which makes them complicit in malicious scareware takeover ads.”
The affiliate was previously reported for abuse, according to Malwarebytes. In a tweet on Sept. 27, YouTube personality and software engineer Jim Browning, who tracks and exposes scams, flagged the affiliate — identified only as “affid=1494” — for a different McAfee campaign involving fake subscription expiration alerts.
A company representative responded to Browning via the McAfee Help account, stating, “McAfee takes reports of these activities seriously as a threat to both our customers and brand and we work to stop such activities when we are made aware of them. Thank you for bringing this to our attention.” However, Malwarebytes said in its report that the affiliate’s activity “continues unabated.”
Jérôme Segura, senior director of threat intelligence at Malwarebytes, said researchers were able to identify the malicious affiliate through only its ID number, affid=1494, in the landing pages’ URLs. However, he said this affiliate has been engaged in malicious activity for years, citing a tweet from September 2020 in which the McAfee Help account said a related user complaint had been sent to the company’s legal team.
“As far as we can tell, this affiliate has not been banned yet. We also reported it on several occasions,” Segura told TechTarget Editorial.
UPDATE 12/4: A McAfee spokesperson told TechTarget Editorial that the malicious affiliate had already been removed prior to the publication of Malwarebytes’ report.
“McAfee takes affiliate fraud very seriously, and should an affiliate partner violate our policy agreements, we act quickly to remove them,” the spokesperson said in a statement. “In this instance, on 11/20, we identified the affiliate in question as violating our policy, and this partner was swiftly removed from our program on 11/21. The Affiliate ID mentioned is an internal tracking parameter for our program and is not specific to any one single affiliate partner, hence why the ID itself is still visible, even when the partner is removed.”
Source: www.techtarget.com
