Yahoo Users Infected with Malware After Ads Hijacked

Yahoo has confirmed that their ads on European websites were subject to a malware injection attack from Dec 31 to Jan 3.

Hundreds of thousands of Yahoo users in European countries including the UK, France and Romania may have been infected with malware injected into advertising hosted on Yahoo websites.

Dutch company Fox-IT made the discovery at the end of last week, saying users who visited Yahoo would be confronted with advertisements that would direct them to external sites hosting malware that exploits Java security flaws.

The ads were served in iframes by Yahoo’s advertising service, and were hosted on external sites. Upon clicking the advertisements, users would be redirected to a selection of other domains, all reporting the same Netherlands-based IP address.

The malware users were faced with include money-grabbing Zeus Trojan, botnet software Andromeda and other malware associated with advertising.

Fox-IT estimates that the traffic to the malware hosts was around 300,000 visits per hour. On the assumption that nine percent of those users would ultimately be infected, the firm says around 27,000 infections could have occurred every hour over the four days the adverts were present.

Yahoo confirmed the news in a statement shared with V3: “From 31 December to 3 January on our European sites, we served some advertisements that did not meet our editorial guidelines – specifically, they spread malware. On January 3, we removed these advertisements from our European sites.”

The statement added that users in other regions and those using Apple’s Mac OS and mobile devices were not affected. “We will continue to monitor and block any advertisements being used for this activity. We will post more information for our users shortly.”

The attack bore a resemblance to the one carried out on the PHP.net website, Fox-IT said. In recent months, popular services including Dropbox and Microsoft Silverlight have found themselves under attack, highlighting the risk businesses face when allowing employees to use personal service on their work devices, or allowing them to bring personal devices into work.

This article was originally published on V3.

Subscribe to get your daily business insights

Whitepapers

US Mobile Streaming Behavior
Whitepaper | Mobile

US Mobile Streaming Behavior

5y

US Mobile Streaming Behavior

Streaming has become a staple of US media-viewing habits. Streaming video, however, still comes with a variety of pesky frustrations that viewers are ...

View resource
Winning the Data Game: Digital Analytics Tactics for Media Groups
Whitepaper | Analyzing Customer Data

Winning the Data Game: Digital Analytics Tactics for Media Groups

5y

Winning the Data Game: Digital Analytics Tactics f...

Data is the lifeblood of so many companies today. You need more of it, all of which at higher quality, and all the meanwhile being compliant with data...

View resource
Learning to win the talent war: how digital marketing can develop its people
Whitepaper | Digital Marketing

Learning to win the talent war: how digital marketing can develop its peopl...

2y

Learning to win the talent war: how digital market...

This report documents the findings of a Fireside chat held by ClickZ in the first quarter of 2022. It provides expert insight on how companies can ret...

View resource
Engagement To Empowerment - Winning in Today's Experience Economy
Report | Digital Transformation

Engagement To Empowerment - Winning in Today's Experience Economy

1m

Engagement To Empowerment - Winning in Today's Exp...

Customers decide fast, influenced by only 2.5 touchpoints – globally! Make sure your brand shines in those critical moments. Read More...

View resource