Bogus Microsoft Update page appears in wild

By

The latest fake Microsoft Update page laced with malware comes with a sinister twist: a portion of its URL contains the URL for the software giant's actual update site, with a period substituted for a forward slash.

Bogus Microsoft Update page appears in wild
The slightly modified URL takes the victim to a fake Microsoft Update “welcome” page that prominently features an urgent notice telling the visitor to install a “critical Windows XP/2000/2003/Vista update!” Install is mispelled on the bogus update page (“intall”), F-Secure reported.

An “Urgent Install” button appears in the fake notice, next to a prompt reading “Get critical update (obligatory).”  Users who click on the button receive a file labeled WindowsUpdateAgent30-x86-x64.exe, which installs a trojan-dropper on the victim's PC. F-Secure said the bogus update page is a “fast flux” site and uses a wide range of IP addresses attached to the “cfm48.com" portion of the URL.

The security research firm said in its blog posting that the malicious program delivered via the trojan dropper is a previously identified piece of malware known as Backdoor:W32/Agent.CVU.

Last month, McAfee researchers warned of a MySpace phishing campaign in which users received “friend” requests that attempt to infect them with malware disguised as a Microsoft update.

Users clicking on the profile of the person trying to befriend them were sent to a page overlaid with a bogus Windows pop-up box promising automatic Windows updates, which, when clicked on, installed a malicious mix of trojans on the victim's PC.

See original article on scmagazineus.com
Got a news tip for our journalists? Share it with us anonymously here.
Copyright © SC Magazine, US edition
Tags:

Most Read Articles

Attackers weaponise Linux file names as malware vectors

Attackers weaponise Linux file names as malware vectors

"Widespread data theft" hits Salesforce customers via third party

"Widespread data theft" hits Salesforce customers via third party

Travel eSIMs secretly route traffic over Chinese and undisclosed networks: study

Travel eSIMs secretly route traffic over Chinese and undisclosed networks: study

Home Affairs adds SecOps to new cyber risk overhaul

Home Affairs adds SecOps to new cyber risk overhaul

Log In

  |  Forgot your password?