Yontoo adware used to cash in on clicks targets Mac and Windows users

Share this article:

Mac and Windows users eager to watch film trailers online are actually lining the pockets of scammers who are spreading an adware trojan.

Russian anti-virus company Dr. Web on Tuesday detailed how fraudsters are loading a trojan known as "Yontoo" onto users' machines by tricking them into installing a plug-in to watch a movie trailer. The malware is then programmed to embed ads on sites visited by compromised users.

According to Doctor Web, criminals profit from the ads through pay-per-click programs run by online affiliate advertisers.

In addition to spurious add-ons, the trojan is also disguised as media player downloads and other software for enhancing video quality or shortening download times, Doctor Web found.

The Yontoo trojan installs itself on Safari, Chrome and Firefox browsers, popular among Mac users, and transmits data about user browsing sessions to a remote server. Yontoo then embeds code into visited sites, so the infected user sees ads.

The firm said the scam illustrates how “interest in users of Apple-compatible computers grows day by day,” among criminals.

Maxim Weinstein, executive director of StopBadware, a nonprofit that focuses on preventing mischievous web activity, like adware, told SCMagazine.com on Thursday that the pay-per-click model is a favorite among fraudsters.

“They could be making the money just from advertisement [clicks],” Weinstein said of Yontoo scammers. “But you certainly get nervous. If they are willing to use malware to get the ads on your computer, who knows what else they are willing to do for money.”

A representative from Dr. Web could not be reached for comment. 

Share this article:

Sign up to our newsletters

More in News

Research shows vulnerabilities go unfixed longer in ASP

Research shows vulnerabilities go unfixed longer in ASP

A new report finds little difference in the number of vulnerabilities among programming languages, but remediation times vary widely.

Bill would restrict Calif. retailers from storing certain payment data

The bill would ban businesses from storing sensitive payment data, for any long than required, even if it is encrypted.

Amplification, reflection DDoS attacks increase 35 percent in Q1 2014

Amplification, reflection DDoS attacks increase 35 percent in ...

The Q1 2014 Global DDoS Attack Report reveals that amplification and reflection distributed denial-of-service attacks are on the rise.