Users who download and run the “Symantec Malware Detector” will instead be infected with malware. However, they could also simply be the result of people being tricked into thinking the fake blog post is real. Given the fact that the primary goal of the Proton malware is to steal passwords, these could be hacked accounts whose passwords were compromised in a previous Proton outbreak. Some of the accounts tweeting the link appear to be fake accounts, but others seem to be legitimate. Unfortunately, links to the fake post have been spreading on Twitter. The fake post promotes a program called “Symantec Malware Detector,” supposedly to detect and remove the malware. In fact, as far as I’ve been able to determine, this is a made-up story, and no such new variant of CoinThief actually exists. The fake post claims that a new variant of CoinThief has been spotted. The fake site contains a blog post about a supposed new version of CoinThief, a piece of malware from 2014. It is legitimate SSL certificate, but was issued by Comodo rather than Symantec’s own certificate authority. The email address used to register the domain is a dead giveaway, however:Įven more suspicious is the certificate used by the site.
#Malwarebytes no longer free 2017 registration#
The registration information for the domain appears, on first glance, to be legitimate, using the same name and address as the legitimate Symantec site. The site is a good imitation of the real Symantec blog, even mirroring the same content. The malware is being promoted via a fake Symantec blog site at symantecblogcom.
#Malwarebytes no longer free 2017 series#
Sunday night, a series of tweets from security researcher revealed a new variant of the OSX.Proton malware, spreading in a concerning new method-spoofing security company Symantec’s blog.
0 kommentar(er)
