Pay-Per-Install Company Deceptively Floods Market with Unwanted Programs

For the past 18 months, McAfee Labs has been investigating a pay-per-install developer, WakeNet AB, responsible for spreading prevalent adware such as Adware-Wajam and Linkury. This developer has been active for almost 20 years and recently has used increasingly deceptive techniques to convince users to execute its installers. Our report is now available online. During […]

The post Pay-Per-Install Company Deceptively Floods Market with Unwanted Programs appeared first on McAfee Blogs.

For the past 18 months, McAfee Labs has been investigating a pay-per-install developer, WakeNet AB, responsible for spreading prevalent adware such as Adware-Wajam and Linkury. This developer has been active for almost 20 years and recently has used increasingly deceptive techniques to convince users to execute its installers. Our report is now available online.

During a 10-month period from September 2017 to June 2018, we observed more than 1.9 million detections in the wild and the generation of thousands of unique websites and URLs. McAfee product protections prevented millions of pieces of adware from being installed on customers’ machines.

 

McAfee Adware-InstCap detections from September 2017 to June 2018.

Some of the deceptive tactics we observed included fake movie playbacks and fake torrent downloads targeting both Windows and Mac systems. These tactics aimed to trick users into installing bundled applications such as performance cleaners.

WakeNet AB’s FileCapital tools are responsible for installing some of the most prevalent potentially unwanted program (PUP) families, which plague infected clients with unwanted advertisements and seriously impact performance.

The revenue WakeNet AB generated in one year puts it above some of the most prevalent ransomware families, which explains why creating PUPs is so appealing. PUP developers generate revenue primarily by exploiting PC users.

PUPs

A PUP is software that might offer some useful functionality to a customer but also presents some risk. Users see some PUPs as benign, others as malicious. One of the latter is Adware-Elex (aka Fireball), which infected 250 million devices. McAfee strives to protect its customers against all kinds of threats, including PUPs.

The McAfee PUP Policy helps users understand what is being installed on their systems and notifies them when a technology poses a risk to their systems or privacy. PUP detection and removal provides notification to our customers when a software program or technology lacks sufficient notification or control over the software, or fails to adequately gain user consent to the risks posed by the technology. For more on how McAfee defines and protects against PUPs, read the McAfee® Potentially Unwanted Programs Policy.

For a full analysis of WakeNet AB’s products, download the full report.

The post Pay-Per-Install Company Deceptively Floods Market with Unwanted Programs appeared first on McAfee Blogs.

SamSam Ransomware

Original release date: December 03, 2018

The Department of Homeland Security and the Federal Bureau of Investigation have identified cyber threat actors using SamSam ransomware—also known as MSIL/SAMAS.A—to target industries in the United States…

Original release date: December 03, 2018

The Department of Homeland Security and the Federal Bureau of Investigation have identified cyber threat actors using SamSam ransomware—also known as MSIL/SAMAS.A—to target industries in the United States and worldwide.

NCCIC encourages users and administrators to review Alert AA18-337A: SamSam Ransomware and Malware Analysis Reports AR18-337A, AR18-337B, AR18-337C, and AR18-337D for more information.


This product is provided subject to this Notification and this Privacy & Use policy.


Marriott breach leaves 500 million exposed with passport, card numbers stolen

Motivations of hackers are unclear, but proprietary Wi-Fi may have been a target.

W Hotel image

Enlarge / Marriott Hotel brands like the W hotel were breached between 2014 and 2018. (credit: Craig Warga/Bloomberg via Getty Images)

On Friday, Marriott International announced a system breach that has affected approximately 500 million customers, with stolen information including names, credit card numbers, mailing addresses, email addresses, and passport numbers. The breach is one of the largest in history, after recent Yahoo breaches that compromised the accounts of nearly three billion customers.

The breach appears to have originated at Starwood hotels in 2014—two years before Marriott acquired the hotel chain, according to The Washington Post. "When Marriott acquired Starwood in 2016, the existing breach went undetected during the merger and for years afterward," the Post noted.

Marriott says it confirmed unauthorized access to the Starwood guest reservation database on November 19, which contained guest information dating back to September 10, 2018. The hackers had allegedly copied encrypted information from the Starwood reservation database. When Marriott was able to decrypt the information, the company found that of the approximately 500 million guests that had their name and contact information stolen, a subset of 327 million had "some combination of name, mailing address, phone number, email address, passport number, Starwood Preferred Guest (“SPG”) account information, date of birth, gender, arrival and departure information, reservation date, and communication preferences."

Read 5 remaining paragraphs | Comments

Protecting Against Identity Theft

Original release date: November 29, 2018

As the holidays draw near, many consumers turn to the internet to shop for goods and services. Although online shopping can offer convenience and save time, shoppers should be cautious online and protect …

Original release date: November 29, 2018

As the holidays draw near, many consumers turn to the internet to shop for goods and services. Although online shopping can offer convenience and save time, shoppers should be cautious online and protect personal information against identity theft. Identity thieves steal personal information, such as a credit card, and run up bills in the victim’s name.

The Cybersecurity and Infrastructure Security Agency (CISA) encourages consumers to review the following tips to help reduce the risk of falling prey to identity theft:

If you believe you are a victim of identity theft, visit the FTC’s identity theft website to file a report and create a personal recovery plan.


This product is provided subject to this Notification and this Privacy & Use policy.