Adware Bundling hits Popular website platforms – Cloned!

Cloned website Pushing Adware

An adware delivery ploy was uncovered recently that involved the distribution of adware programs via clone websites that use legitimate looking domains.  The deceit came to light when a phony website keepass.fr was discovered that replicated the official site keepass.info. Keepass is an open source password manager tool that helps users to manage their passwords for Windows network logon, websites FTP password, email account, online passwords etc in a secure manner.

InstallCore adware is pushed when apps from this clone website are installed

The clone of Keepass password manager app appears legitimate and is fully functional. However it is infected with the malicious InstallCore adware.

InstallCore is an adware program that bundles popular legitimate applications along with malicious third party applications. The user is lured to install the application that comes with a popular title without being aware of making the system susceptible to other adware infections. The offers shown in ads may be legitimate but they do not come alone. They are accompanied by other apps that may be malicious. For instance, crypto currency miners, browser hijackers, adware etc may be pushed along with the legitimate apps.
The motive behind this act is solely monetary. Each successful installation of additional adware programs earns a commission fee to the adware bundlers.

Other similar Cloned website Pushing Adware discovered

Keepass.fr is not the only cloned website. It is just a part of much collection of  typo squatted domains.

• Typosquatting URL’s: It is a form of cyber squatting that relies on mistakes made by internet users like typos when inputting a website address.

For instance: If movies.com is a legitimate site, the typosquatter’s URL could be:

1. moveis.com – A misspell based on typos
2. movie.com – Differently phrased domain name
3. movies.org – A different top level domain etc

Typos made by users will land them on typosquatter’s website tricking them into thinking that they are on the real web page.
Other fake domains registered by this individual/group used famous sites such as:

1. GParted etc.
2. Truecrypt
3. 7Zip
4. Inkscape
5. Audacity
6. Fileilla

• Different TLD (Top Level domain): TLD is the highest level domain in the hierarchical domain name system of the internet. For instance, in the domain movies.com, top level domain is com.

TLDs mainly used for the registered fake website are .fr and .es. For example, audacity.fr, truecrypt.fr, blender3d.fr, filezilla.fr, thunderbird.es, audacity.es etc

Read Full News :- Click Hear