1413316 - attempted download of malware after being on a yahoo site. Malware is claiming to be a critical Firefox update.

Status: RESOLVED FIXED

(Security Assurance :: General, task)

Description

[Arun]

Attachment: FF poser site.jpg

User Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0
Build ID: 20171026211016

Steps to reproduce:

Was on finance,yahoo.com.  Stepped away from my computer and the suspected Java malware was waiting for permission to download. Claimed to be a "Critical Firefox Update" with a download button.  I didn't click the download button


Actual results:

Stepped away from my computer and the suspected Java malware was waiting for permission to download. Claimed to be a "Critical Firefox Update" with a download button.  I didn't click the download button.  I am attaching a screen shot

Comment 1

[Arun]

here is the URL of the malware site: https://cephopowernet.net/5081694047300/ab7f6f11293970f74fbb66d0294ae1b5/61e3976f700b94c348aa3f38f948e9b3.html

Comment 2

[Jeff Bryner [:jeff] (use NEEDINFO 😉)]

Reported the resulting url to safe browsing for blocking. 

This is likely from an infected ad network. If you don't have an ad blocker, I'd recommend installing one.