The malware swung into action as soon as the visitors visited the site and secretly dumped files to their systems. It is still unclear on how many people have been affected by this bug but considering the fact that Yahoo’s website receives an estimated 6.9bn visits per month the number of victims can be quite high. The attack was carried out by piggybacking on a Microsoft Azure website. Thankfully, the campaign was stopped immediately after MalwareBytes informed Yahoo of the exploit. The malware which downloaded itself onto the system consisted of ad fraud and a ransomware called CryptoWall. Yahoo shut down its advertising scheme and said that “As soon as we learned of this issue, our team took action and will continue to investigate this issue” Malvertising has been negatively affecting the ad network industry as the attackers dosnt need to interact with the users system in order to drop the malware. In fact, simple browsing on the website with infected adverts is enough to trigger a chain of events. Jerome Segura, senior security researcher at Malwarebytes explained “The complexity of the online advertising economy makes it easy for malicious ads to abuse the system and get away with it. It is one of the reasons why we need to work closely with different industry partners to detect suspicious patterns and react very quickly to halt rogue campaigns.” As a user, you need to take some measures in a bid to avoid such attacks on our systems. The first and the foremost cautionary step is that we should avoid opening files from unknown sources and the second step would be to install the software updates as and when they are released. If you think you might be affected by the malware, this old guide from us should probably help you get rid of the infection.
