Yahoo hit by "malvertising" campaign

Yahoo became one of the latest victims of a malvertising attack last week, as a malware company bought ad space on the search engine’s sites to deliver ads that install malware on users’ computers.

According to the Guardian, the campaign took advantage of the vulnerability in Adobe Flash to install the software, a mixture of ad fraud and ransomware programs.

Ransomware stops users from accessing their computer systems, and asks for a ransom to remove the restriction.

Anti-malware software writer Malwarebytes, which detected the malicious activity, said that June and July set new records for malvertising attacks.

Yahoo told the company in a statement: “As soon as we learned of this issue, our team took action and will continue to investigate this issue. Unfortunately, disruptive ad behaviour affects the entire tech industry.”

Malwarebytes described malvertising as a “silent killer”, as malicious ads don’t need any user interaction to execute their payload. “The mere fact of browsing to a website that has adverts (and most sites, if not all, do) is enough to start the infection chain,” it said.

“The complexity of the online advertising economy makes it easy for malicious actors to abuse the system and get away with it. It is one of the reasons why we need to work very closely with different industry partners to detect suspicious patterns and react very quickly to halt rogue campaigns.”