{"id":21836,"date":"2023-04-24T16:10:49","date_gmt":"2023-04-25T00:10:49","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2023\/04\/24\/news-15567\/"},"modified":"2023-04-24T16:10:49","modified_gmt":"2023-04-25T00:10:49","slug":"news-15567","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2023\/04\/24\/news-15567\/","title":{"rendered":"Adult content malvertising scheme leads to clickjacking"},"content":{"rendered":"

Malwarebytes’ researchers have found a malvertising scheme that leads to clickjacking.<\/p>\n

Clickjacking is a form of ad fraud which is also referred to as click fraud or click spam. It is a practice performed by certain dubious advertising networks, where they sometimes use automated programs—from simple to sophisticated bots and botnets—to interact with advertisements online. But it can also be done by tricking legitimate users into clicking ads, visiting pages, and (in some cases) creating fake form submissions.<\/p>\n

Ad fraud means that the advertiser pays the referrer or the advertising network to show their ads to interested visitors. In reality, the criminal doesn’t care who actually clicks or whether they are interested, as long as the money keeps coming their way.<\/p>\n<\/p>\n

The campaign<\/h2>\n

To start things up, visitors are lured to several fake blogs about topics they might find interesting.<\/p>\n

\"theThis is how the actual blog looks<\/em><\/p>\n

The original blog however is hidden by an overlay showing blurred explicit content and a button asking the visitor to confirm they are 18+ and asking if they want to enter the website. We have seen a few different overlays on the same website, so there could some fingerprinting involved. Below are a few examples:<\/p>\n

\"example<\/p>\n

\"overlay<\/p>\n

Whichever one the visitor sees, clicking the button does nothing other than registering a click on an advertisement. However, that does help the cybercriminals set up this clickjacking scheme. <\/p>\n

\"advertisement<\/p>\n

Above is an example of an advertisement shown to a Dutch IP and, below, a screenshot of the Google ad that was presented to a Canadian IP address.<\/p>\n

\"full<\/p>\n

This is the link behind the version you can see here:<\/p>\n

\"overlayDragging the button allows the visitor to see where the click will take them<\/em><\/p>\n

The code behind these attacks is obfuscated.<\/p>\n

\"obfuscated<\/p>\n

In this case there is no imminent danger for the website visitor. It is just wasted money for the advertiser. So, if you run into one of these, don’t make them any richer by clicking that 18+ button.<\/p>\n

If you are spending money on advertising it is worth looking at what you get for the money your are spending. According to research carried out by BusinessOfApps<\/a> the total cost of ad fraud in 2022 was around $81 billion, and is predicted to increase to $100 billion by 2023.<\/p>\n

If the spending and return on investment are non-transparent, advertisers can also look at solutions that can significantly reduce their advertising costs. You can try some<\/a> for free for up to 5,000 paid clicks per month on the Google Ads platform.<\/p>\n

\n

Malwarebytes removes all remnants of ransomware and prevents you from getting reinfected. Want to learn more about how we can help protect your business? Get a free trial below.<\/p>\n

TRY NOW<\/a><\/p>\n

https:\/\/blog.malwarebytes.com\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"\n\n
\n

Categories: News<\/a><\/p>\n

Tags: 18+<\/p>\n

Tags: malvertising<\/p>\n

Tags: Google ads<\/p>\n

Tags: clickjacking<\/p>\n

Malwarebytes’ researchers have discovered a malvertising scheme that uses adult lures for clickjacking purposes.<\/p>\n\n\n
\n

(Read more…<\/a>)<\/b><\/p>\n<\/td>\n<\/tr>\n<\/table>\n<\/td>\n<\/tr>\n<\/table>\n

The post Adult content malvertising scheme leads to clickjacking<\/a> appeared first on Malwarebytes Labs<\/a>.<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10488,10378],"tags":[29206,20894,10529,10531,32],"class_list":["post-21836","post","type-post","status-publish","format-standard","hentry","category-malwarebytes","category-security","tag-29206","tag-clickjacking","tag-google-ads","tag-malvertising","tag-news"],"_links":{"self":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/21836","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=21836"}],"version-history":[{"count":0,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/21836\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=21836"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=21836"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=21836"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}