Pornhub malvertising attack affects millions of users

Malvertising incidents are also expanding to whitelisted websites, expert warns

A large-scale malvertising attack saw millions of users of adult video website Pornhub tricked into installing malware on the computers, according to security researchers.

The campaign was active for more than a year, exposing millions of potential victims in the US, Canada, the UK, and Australia to fake software updates that actually installed malware, said IT security researchers at Proofpoint in a blog post

The attacks were carried out by a hacking group known as KovCoreG. It is best known for distributing Kovter ad fraud malware and sitting atop the affiliate model that distributes Kovter more widely.  

Victims were shown fake notifications of updates to their Chrome or Firefox web browser or Flash. When a file was downloaded, it installed Kovtar. This then was used by criminals to fake click on adverts. However, these clicks made money for criminals. 

Advertisement - Article continues below
Advertisement - Article continues below

"The combination of large malvertising campaigns on very high-ranking websites with sophisticated social engineering schemes that convince users to infect themselves means that potential exposure to malware is quite high, reaching millions of web surfers," said the researchers. 

"Once again, we see actors exploiting the human factor even as they adapt tools and approaches to a landscape in which traditional exploit kit attacks are less effective."

While the payload here is ad fraud malware, it could just as easily have been ransomware, an information stealer, or any other malware. 

"Regardless, threat actors are following the money and looking to more effective combinations of social engineering, targeting, and pre-filtering to infect new victims at scale," they added. 

Pornhub, which has its own bug bounty programme, acted swiftly to fix the issue when Proofpoint made it aware of the issue.

Chris Olson, CEO of The Media Trust, told IT Pro that the widespread notion that malvertising is on the decline just isn't true, and that it's even extending to websites you'd be happy to visit at work. 

Advertisement - Article continues below

"In fact, malvertising incidents have more than doubled in the past three years and are increasingly found on premium websites that are typically whitelisted by enterprises for employee internet use," he said. 

"Fake virus alerts and system updates delivering malicious exploit kits are ubiquitous in today's highly complex and dynamic digital ecosystem. In order to effectively deliver malware and exploit kits, threat actors have resorted to sophisticated coding to enable advanced filtering," he added.

"There has been a surge in the detection-evading malware that only executes when conditions are favourable. Furthermore, in order to accurately target and deliver malware to specific endpoints and internet users, threat actors exploit the very technologies that website owners utilise to deliver customised and personalised content to their users."

Featured Resources

Digitally perfecting the supply chain

How new technologies are being leveraged to transform the manufacturing supply chain

Download now

Three keys to maximise application migration and modernisation success

Harness the benefits that modernised applications can offer

Download now

Your enterprise cloud solutions guide

Infrastructure designed to meet your company's IT needs for next-generation cloud applications

Download now

The 3 approaches of Breach and Attack Simulation technologies

A guide to the nuances of BAS, helping you stay one step ahead of cyber criminals

Download now



Hackers abuse LinkedIn DMs to plant malware

25 Feb 2019

Best free malware removal tools 2019

23 Dec 2019

Best antivirus for Windows 10

3 Sep 2019

Most Popular

operating systems

17 Windows 10 problems - and how to fix them

13 Jan 2020

Windows 10 and the tools for agile working

20 Jan 2020
Microsoft Windows

What to do if you're still running Windows 7

14 Jan 2020
web browser

What is HTTP error 503 and how do you fix it?

7 Jan 2020