Malware spotted lurking on YouPorn and Pornhub

Malvertising campaign had 800 million potential victims before being removed

More malware targeting popular porn sites emerged over the weekend, with Pornhub and YouPorn being the latest affected.

Spotted by security firm Malwarebytes, hackers inserted a rogue piece of legitimate-seeming code into the ExoClick ad network used by the websites, with the resulting adware appearing as an ad banner.

The malicious code, known as cookiecheck.js, was quickly removed by the ad network and by the porn sites' publisher, MindGeek, thereby protecting their 800 million monthly visitors.

But had the code not been spotted quickly, it would have redirected victims to an Angler Exploit Kit that hackers could have used to infect their victims' computers with programs like ransomware.

Other porn sites have been served similar malware by hackers in the last fortnight, with xHamster targeted by an SSL malvertising campaign that was first seen on Yahoo.com and MSN.com.

Malwarebytes called the recent prevalance of porn site attacks "strange", adding: "During the past several months, high profile malvertising attacks against top adult sites have been sparse.

"This makes what we have seen during the past couple of weeks very unusual but also impactful given the sheer volume of traffic these sites receive."

MindGeek said in a statement: "We were alerted to the presence of a malicious advertisement appearing on a select few of Pornhub's web properties. It was quickly determined that the malware originated from a third party advertising partner, and we responded immediately to disable all advertisements associated with this third party, and continue to actively investigate this incident."

Featured Resources

Humility in AI: Building trustworthy and ethical AI systems

How humble AI can help safeguard your business

Download now

Future of video conferencing

Optimising video conferencing features to achieve business goals

Download now

Leadership compass: Privileged Access Management

Securing privileged accounts in a high-risk environment

Download now

Why you need to include the cloud in your disaster recovery plan

Preserving data for business success

Download now

Recommended

Android apps still vulnerable to a major bug despite an existing patch
Google Android

Android apps still vulnerable to a major bug despite an existing patch

3 Dec 2020
20 Universities targeted by “Shadow Academy” hackers
hacking

20 Universities targeted by “Shadow Academy” hackers

3 Dec 2020
IBM: Hackers are targeting COVID-19 vaccine 'cold chain'
Security

IBM: Hackers are targeting COVID-19 vaccine 'cold chain'

3 Dec 2020
New Trickbot variant can interfere with UEFI and BIOS
malware

New Trickbot variant can interfere with UEFI and BIOS

3 Dec 2020

Most Popular

Samsung Galaxy Note might be discontinued in 2021
Mobile Phones

Samsung Galaxy Note might be discontinued in 2021

1 Dec 2020
Microsoft Teams no longer works on Internet Explorer
Microsoft Office

Microsoft Teams no longer works on Internet Explorer

30 Nov 2020
Sopra Steria cyber attack costs to hit €50 million
Security

Sopra Steria cyber attack costs to hit €50 million

26 Nov 2020