Yontoo adware used to cash in on clicks targets Mac and Windows users

Share this article:

Mac and Windows users eager to watch film trailers online are actually lining the pockets of scammers who are spreading an adware trojan.

Russian anti-virus company Dr. Web on Tuesday detailed how fraudsters are loading a trojan known as "Yontoo" onto users' machines by tricking them into installing a plug-in to watch a movie trailer. The malware is then programmed to embed ads on sites visited by compromised users.

According to Doctor Web, criminals profit from the ads through pay-per-click programs run by online affiliate advertisers.

In addition to spurious add-ons, the trojan is also disguised as media player downloads and other software for enhancing video quality or shortening download times, Doctor Web found.

The Yontoo trojan installs itself on Safari, Chrome and Firefox browsers, popular among Mac users, and transmits data about user browsing sessions to a remote server. Yontoo then embeds code into visited sites, so the infected user sees ads.

The firm said the scam illustrates how “interest in users of Apple-compatible computers grows day by day,” among criminals.

Maxim Weinstein, executive director of StopBadware, a nonprofit that focuses on preventing mischievous web activity, like adware, told SCMagazine.com on Thursday that the pay-per-click model is a favorite among fraudsters.

“They could be making the money just from advertisement [clicks],” Weinstein said of Yontoo scammers. “But you certainly get nervous. If they are willing to use malware to get the ads on your computer, who knows what else they are willing to do for money.”

A representative from Dr. Web could not be reached for comment. 

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

TOP COMMENTS

More in News

Florida Supreme Court rules warrants a must for real-time cell location tracking

Florida Supreme Court rules warrants a must for ...

The Florida Supreme Court put the kibosh on warrantless real-time tracking using location data obtained from cell phone providers.

Modular malware for OS X includes backdoor, keylogger components

Modular malware for OS X includes backdoor, keylogger ...

The modular malware was named "Ventir," by researchers at Kaspersky.

Fake Dropbox login page nabs credentials, is hosted on Dropbox

Fake Dropbox login page nabs credentials, is hosted ...

Symantec researchers received a phishing email linking recipients to a fake Dropbox login page that is hosted on Dropbox's user content domain and served over SSL.