Beware of Fake Adobe Flash Updates

mirror

Mon, Oct 28 2013, 11:57 am

Quote:

Adobe Flash is one of the most widely distributed products on the Internet. Because of its popularity and global install base, it is often a target of cybercriminals. Cybercriminals are using social engineering methods to distribute their malware through fake Flash update sites, often compelling unsuspecting users, who may be in need of a software update, to unknowingly install malware.

Quote:

The attacker’s main goal is to make sure that a successful installation occurs, and presents two options to the user for maximum return.

Option 1 is a pop-up message that requests the user to download a file named flash_player_updater.exe.

Option 2 is the “Download Now” button that requests the user to download a file named update_flash_player.exe.

During our analysis we found that, in addition to stealing passwords, these files appear to be looking for FTP/telnet/SSH credentials for all of the popular clients currently in use. They also monitor for SMTP, IMAP, and POP3 credentials.