Pornhub malvertising attack affects millions of users

Malvertising incidents are also expanding to whitelisted websites, expert warns

A large-scale malvertising attack saw millions of users of adult video website Pornhub tricked into installing malware on the computers, according to security researchers.

The campaign was active for more than a year, exposing millions of potential victims in the US, Canada, the UK, and Australia to fake software updates that actually installed malware, said IT security researchers at Proofpoint in a blog post

Advertisement - Article continues below

The attacks were carried out by a hacking group known as KovCoreG. It is best known for distributing Kovter ad fraud malware and sitting atop the affiliate model that distributes Kovter more widely.  

Victims were shown fake notifications of updates to their Chrome or Firefox web browser or Flash. When a file was downloaded, it installed Kovtar. This then was used by criminals to fake click on adverts. However, these clicks made money for criminals. 

"The combination of large malvertising campaigns on very high-ranking websites with sophisticated social engineering schemes that convince users to infect themselves means that potential exposure to malware is quite high, reaching millions of web surfers," said the researchers. 

"Once again, we see actors exploiting the human factor even as they adapt tools and approaches to a landscape in which traditional exploit kit attacks are less effective."

Advertisement - Article continues below

While the payload here is ad fraud malware, it could just as easily have been ransomware, an information stealer, or any other malware. 

Advertisement - Article continues below

"Regardless, threat actors are following the money and looking to more effective combinations of social engineering, targeting, and pre-filtering to infect new victims at scale," they added. 

Pornhub, which has its own bug bounty programme, acted swiftly to fix the issue when Proofpoint made it aware of the issue.

Chris Olson, CEO of The Media Trust, told IT Pro that the widespread notion that malvertising is on the decline just isn't true, and that it's even extending to websites you'd be happy to visit at work. 

"In fact, malvertising incidents have more than doubled in the past three years and are increasingly found on premium websites that are typically whitelisted by enterprises for employee internet use," he said. 

"Fake virus alerts and system updates delivering malicious exploit kits are ubiquitous in today's highly complex and dynamic digital ecosystem. In order to effectively deliver malware and exploit kits, threat actors have resorted to sophisticated coding to enable advanced filtering," he added.

Advertisement - Article continues below

"There has been a surge in the detection-evading malware that only executes when conditions are favourable. Furthermore, in order to accurately target and deliver malware to specific endpoints and internet users, threat actors exploit the very technologies that website owners utilise to deliver customised and personalised content to their users."

Featured Resources

Preparing for long-term remote working after COVID-19

Learn how to safely and securely enable your remote workforce

Download now

Cloud vs on-premise storage: What’s right for you?

Key considerations driving document storage decisions for businesses

Download now

Staying ahead of the game in the world of data

Create successful marketing campaigns by understanding your customers better

Download now

Transforming productivity

Solutions that facilitate work at full speed

Download now


Google Android

Over two dozen Android apps found stealing user data

7 Jul 2020

Best antivirus for Windows 10

30 Jun 2020

Searching for a new job? That LinkedIn job offer may be fake

19 Jun 2020

Evasive malware threats doubled in 2019

24 Mar 2020

Most Popular

Business operations

Nvidia overtakes Intel as most valuable US chipmaker

9 Jul 2020

How to find RAM speed, size and type

24 Jun 2020
Google Android

Over two dozen Android apps found stealing user data

7 Jul 2020