{"id":3911,"date":"2017-03-16T15:07:43","date_gmt":"2017-03-16T07:07:43","guid":{"rendered":"https:\/\/glutenfreepleasure.com\/__proxy_domain\/dev.itsolution.com.sg\/?p=3911"},"modified":"2020-02-11T13:52:11","modified_gmt":"2020-02-11T05:52:11","slug":"malware-alert-hackers-trick-users-into-downloading-fake-google-chrome-font-pack","status":"publish","type":"post","link":"https:\/\/glutenfreepleasure.com\/__proxy_domain\/www.itsolution.com.sg\/security\/malware-alert-hackers-trick-users-into-downloading-fake-google-chrome-font-pack\/","title":{"rendered":"Malware Alert: Hackers Trick Users into Downloading Fake Google Chrome Font Pack"},"content":{"rendered":"

New Hacker Gimmick: The Release of Fake Google Chrome Font Pack Can Affect You<\/h2>\n

\"MalwareGoogle Chrome users have been cautioned to be on the alert for scammers and hackers prompting them to download a fake Google Chrome font pack update just to trick them into installing malware on their systems.<\/p>\n

This scam has apparently been making its rounds since January this year. Proofpoint<\/a> researchers have discovered this, saying only Chrome users on Windows are potential victims.<\/p>\n

Moreover, the researchers also claimed that it only affected users from specific countries and only if they navigated to a compromised website using a specific route, such as search engine results.<\/p>\n

If Chrome users come across such websites, the script then makes the website unreadable and prompts them to fix the issue by updating their ‘Google Chrome font pack.’<\/p>\n

 <\/p>\n

‘HoeflerText’ Font<\/h3>\n

The prompt window would say: “The ‘HoeflerText’ font wasn’t found”. With this, there will be a prompt to update the “Chrome Font Pack.” If users clicked on it, it actually installs a malware trojan on your machine.<\/p>\n

\"Malware<\/p>\n

The technique relies on attackers compromising websites and adding their own scripts to the site’s source code. Meanwhile, these scripts filter out the incoming traffic and load another malicious script only for Chrome users on Windows.<\/p>\n

 <\/p>\n

Destroys Web Page Content<\/h3>\n

This second script will replace HTML tags with “& # 0,” which ruins the site’s content and displays “\ufffd” characters all over the page.<\/p>\n

Apparently, the scam can infect victims’ computers with Spora ransomware. This is one of the most active ransomware operations with live infection channels, crypto, and ransom payment service.<\/p>\n

To give it legitimacy, the pop-up has Google Chrome’s logo and uses classic button styles. Incredibly, they mirror the official Google Chrome website.<\/p>\n

According to some reports, only a very small number of anti-malware apps are detecting this particular attack right now.<\/p>\n

This malware was primarily successful due to its ability to fly under the radar. Also, it does not get the recognition as an infection by a variety of security programmes.<\/p>\n

Proofpoint says the font update packages that users download via this technique come with the Fleercivet click-fraud malware. This works by navigating to preset URLs and clicking on hidden ads behind the user’s back, earning crooks money.<\/p>\n

This same malware was present on underground cybercrime services. There’s one under the name of Simby in early 2015, and Clicool in late 2015 and in 2016.<\/p>\n

These ads aim to promote the installation of additional questionable content. This includes web browser toolbars, optimization utilities, and other products. Further, when users click on the ads, the adware publisher can generate pay-per-click revenue. Other malicious adware programmes might enter the computer without the user\u2019s knowledge.<\/p>\n

Though Chrome doesn\u2019t flag the download as malware, the browser blocks the file with a warning message \u201cthis file isn\u2019t downloaded very often\u201d.<\/p>\n

This is a standard warning and next time you notice it better skip the download process of the file. The timely reaction could enable you to avoid ransomware<\/a> infection.<\/p>\n

\"Malware<\/p>\n

 <\/p>\n

 <\/p>\n

Scammers are Quickly Improving their Techniques to Deceive<\/h3>\n

Scammers are quickly improving their techniques to deceive users online. Therefore, it always pays to be careful of the sites we visit on the internet, as well as the files we download even if it’s the Google Chrome Font Pack.<\/p>\n

Consult IT professionals for advice if you require any help. You may also contact us<\/a> at IT Solution<\/a> for more information.<\/p>\n","protected":false},"excerpt":{"rendered":"

New Hacker Gimmick: The Release of Fake Google Chrome Font Pack Can Affect You Google Chrome users have been cautioned to be on the alert for scammers and hackers prompting them to download a fake Google Chrome font pack update just to trick them into installing malware on their systems. This scam has apparently been…<\/p>\n","protected":false},"author":1,"featured_media":3916,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"rank_math_title":"Downloading Fake Google Chrome Font Pack: Hackers New Trick","rank_math_description":"Google Chrome users to be on the alert when prompted to download a fake Google Chrome font pack to trick them into installing malware on their systems.","rank_math_focus_keyword":"Google Chrome Font Pack","rank_math_canonical_url":"","footnotes":""},"categories":[21],"tags":[],"class_list":["post-3911","post","type-post","status-publish","format-standard","has-post-thumbnail","category-security","category-21","description-off"],"_links":{"self":[{"href":"https:\/\/glutenfreepleasure.com\/__proxy_domain\/www.itsolution.com.sg\/wp-json\/wp\/v2\/posts\/3911","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/glutenfreepleasure.com\/__proxy_domain\/www.itsolution.com.sg\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/glutenfreepleasure.com\/__proxy_domain\/www.itsolution.com.sg\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/glutenfreepleasure.com\/__proxy_domain\/www.itsolution.com.sg\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/glutenfreepleasure.com\/__proxy_domain\/www.itsolution.com.sg\/wp-json\/wp\/v2\/comments?post=3911"}],"version-history":[{"count":6,"href":"https:\/\/glutenfreepleasure.com\/__proxy_domain\/www.itsolution.com.sg\/wp-json\/wp\/v2\/posts\/3911\/revisions"}],"predecessor-version":[{"id":6645,"href":"https:\/\/glutenfreepleasure.com\/__proxy_domain\/www.itsolution.com.sg\/wp-json\/wp\/v2\/posts\/3911\/revisions\/6645"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/glutenfreepleasure.com\/__proxy_domain\/www.itsolution.com.sg\/wp-json\/wp\/v2\/media\/3916"}],"wp:attachment":[{"href":"https:\/\/glutenfreepleasure.com\/__proxy_domain\/www.itsolution.com.sg\/wp-json\/wp\/v2\/media?parent=3911"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/glutenfreepleasure.com\/__proxy_domain\/www.itsolution.com.sg\/wp-json\/wp\/v2\/categories?post=3911"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/glutenfreepleasure.com\/__proxy_domain\/www.itsolution.com.sg\/wp-json\/wp\/v2\/tags?post=3911"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}