[VipJCCS]

Attackers Deliver Malware via Fake Website Certificate Errors

If anyone has seen website certification errors, they know that it is generally a good idea to stay away from those websites. The malicious actors behind these attacks use this to their advantage by displaying an iframe from their domain over compromised websites and luring victims into downloading a “fix.” The downloaded file will infect the victim with either the Buerak Trojan or the Mokes backdoor when it is run.

What makes this attack so effective is that it looks similar to the Chrome certificate warning page except for text and button driving the victim to download a file. The URL bar also displays the correct URL for the visited website, so one can’t tell that the current iframe is malicious just by looking at the URL.

Topic