Security analysts at Check Point have discovered a browser hijacking operation called “Fireball” that has already claimed 250 million victims globally. Fireball starts off as a browser hijack with the ability to manipulate page views and redirect users, but can also be used as a malware downloader, according to Check Point.
The name “Fireball” was given to the campaign by Check Point researchers.
“The name does not derive from the malware’s characteristics or original name,” Maya Horowitz, group manager for threat intelligence at Check Point, told eWEEK.
Fireball is not exploiting any new zero-day vulnerability; rather it is installed on unsuspecting Microsoft Windows operating system user systems as part of a software bundle. Bundling unwanted and unknown components as part of a software download is commonly referred to as potentially unwanted programs (PUPs). Among the common downloads that include Fireball are several freeware applications, including Deal Wifi, Mustang Browser, Soso Desktop and FVP Imageviewer. Horowitz noted that most Fireball samples are identified as PUPs by the Virus Total free online scanning service.
“Victims download and install the malware, thinking that it’s a different freeware,” she said. “As there is a huge install base, we assume there are additional attack vectors of which we are not aware.”
Check Point found Fireball infections all over the world, with 25.3 million infections in India, another 24.1 million in Brazil and 13.1 million in Indonesia. In contrast, the number of U.S. infections stands at 5.5 million, according to Check Point.
Check Point’s analysis found that Fireball makes use of sophisticated anti-detection techniques to avoid being blocked by security software and includes a flexible command and control structure at the back end. Although Check Point is calling Fireball malware, it is actually being run by a Chinese digital marketing agency called Rafotech as a tool to expand advertising reach.
“We haven’t contacted them [Rafotech] to see the behavior of the malware as enough to declare it as such,” Horowitz said. “To emphasize—the malware does not conduct pure malicious behavior currently, but merely hijacks the search page, but is able to download and run any additional code at any given time.”
In Check Point’s report on Fireball, the company noted that one possible scenario could be where the operators of Fireball decide to harvest sensitive information from all of the infected systems and sell the data to threat groups.
“Banking and credit card credentials, medical files, patents and business plans can all be widely exposed and abused by threat actors for various purposes,” Check Point’s report stated. “The potential loss is indescribable and repairing the damage caused by such massive data leakage (if even possible) could take years.”
For users to protect themselves against browser highjacks like Fireball, Horowitz has some advice. She suggests that users be aware of any suspicious behavior of devices and web browsers. In particular, one of the key signs that a browser may have been highjacked is if the user’s homepage has been changed without user interaction.
