A recently found malvertising campaign is targeting the Chrome users and redirecting them to websites which they can’t leave without installing a malicious Chrome extension.
While this is not exactly a common practice among the malvertising, which generally redirects the users to places where a stronger malware can be delivered, including adware, ransomware, banking trojans.
The expert from Malwarebytes, Jérôme Segura said that these recent malvertising campaigns are targeting Chrome users and redirecting them to other scam sites, rather traditionally redirecting to malware-ridden sites.
Segura wrote saying,”This malvertising flow (an XML feed) demonstrates how the user is redirected to a fake site which is forcing them to install a Google Chrome extension. Enticing may, in fact be a euphemism, since in this case user is giving no choice other than to ‘Add Extension to Leave’, while their browser is just stuck in a never ending loop of those fullscreen modes,” Segura writes.
So what will happen once this extension is installed? It will make sure that it stays in hiding by using a 1×1 pixel image as the logo, which becomes a blank space next to the Chrome menu, where extensions are generally present. It also hooks the chrome://settings and chrome://extensions in such a way that any attempts to access these is automatically redirected to chrome://apps so that users cannot get the extension uninstalled.
The bad stuff is in a couple of JavaScript files. One has a connection to a command & control server where it can receive instructions on what to do next.
“The perpetrators behind this extension are checking for certain keywords within the current URL and blocking/redirecting if the conditions are met. For instance, if the user tries to visit the Malwarebytes website, the browser will immediately get redirected, first to a YouTube video, and then to one of various Potentially Unwanted Programs (PUPs), get-rich-quick schemes, and various other scams,” the blog reads.