Equifax website borked again, this time to redirect to fake Flash update

In May credit reporting service Equifax's website was breached by attackers who eventually made off with Social Security numbers, names, and a dizzying amount of other details for some 145.5 million US consumers. For several hours on Wednesday, and again early Thursday morning, the site was maliciously manipulated again, this time to deliver fraudulent Adobe Flash updates, which when clicked, infected visitors' computers with adware that was detected by only three of 65 antivirus providers.

Randy Abrams, an independent security analyst by day, happened to visit the site Wednesday evening to check what he said was false information he had just found on his credit report. Eventually, his browser opened up a page on the domain hxxp//:centerbluray.info that looked like this:


Randy Abrams



He was understandably incredulous. The site that previously gave up personal data for virtually every US person with a credit history was once again under the influence of attackers, this time trying to trick Equifax visitors into installing crapware Symantec calls Adware.Eorezo. Knowing a thing or two about drive-by campaigns, Abrams figured the chances were slim he'd see the download on follow-on visits. To fly under the radar, attackers frequently serve the downloads to only a select number of visitors, and then only once.

Abrams tried anyway, and to his amazement, he encountered the bogus Flash download links on at least three subsequent visits. The picture above this post is the higher-resolution screenshot he captured during one visit. He also provided the video below. It shows an Equifax page redirecting the browser to at least four domains before finally opening the Flash download at the same centerbluray.info page.



Equifax Flash Download

The file that got delivered when Abrams clicked through is called MediaDownloaderIron.exe. This VirusTotal entry shows only Panda, Symantec, and Webroot detecting the file as adware. This separate malware analysis from Payload Security shows the code is highly obfuscated and takes pains to conceal itself from reverse engineering. Malwarebytes flagged the centerbluray.info site as one that pushes malware, while both Eset and Avira provided similar malware warnings for one of the intermediate domains, newcyclevaults.com.

https://arstechnica.com/information-technology/2017/10/equifax-webs...

Views: 175

Comment

You need to be a member of 12160 Social Network to add comments!

Join 12160 Social Network

"Destroying the New World Order"

TOP CONTENT THIS WEEK

THANK YOU FOR SUPPORTING THE SITE!

mobile page

12160.info/m

12160 Administrators

 

Latest Activity

Doc Vega posted blog posts
12 hours ago
Burbia favorited tjdavis's photo
23 hours ago
FREEDOMROX's blog post was featured
yesterday
cheeki kea commented on cheeki kea's blog post WHY YOU MUST UNDERSTAND AMYLOIDOSIS AND AMYLOID PLAQUES June 13, 2022
yesterday
FREEDOMROX posted a blog post
yesterday
Doc Vega commented on Doc Vega's blog post The Many Keys to Deadly Secrecy in our Government
"cheeki kea, thanks so much for your support."
yesterday
FREEDOMROX posted a blog post
Thursday
cheeki kea favorited Doc Vega's blog post The Many Keys to Deadly Secrecy in our Government
Thursday
cheeki kea commented on cheeki kea's photo
Thursday
cheeki kea posted a photo
Wednesday
cheeki kea replied to cheeki kea's discussion Tartaria
"Greetings to you John, You're right and it didn't take long for those manuals to totally…"
Wednesday
Doc Vega posted a blog post

The Many Keys to Deadly Secrecy in our Government

We now know thanks to the legislation of FOIA access to federal documents and evidence and the…See More
Wednesday
Less Prone favorited tjdavis's photo
Wednesday
Less Prone favorited rlionhearted_3's photo
Wednesday
John Miller commented on rlionhearted_3's photo
Thumbnail

Another incredibly Stupid!! What, no mirrors?

"Brutal post... not sure it’s helping anyone though."
Tuesday
John Miller replied to cheeki kea's discussion Tartaria
"Tartaria: the empire that built half the world's cathedrals, then vanished because someone…"
Tuesday
Burbia commented on rlionhearted_3's photo
Thumbnail

Another incredibly Stupid!! What, no mirrors?

"This movie portrayed plastic surgery as absurd. I guess the numbers in the real world are growing."
Tuesday
Burbia commented on tjdavis's photo
Thumbnail

Redux

"Ah yes, General Jussitri Smolletkov. Good tongzhi. Good tongzhi."
Tuesday
Doc Vega posted a blog post

Unusual Discoveries and Headlines

Archaeologists have discovered an ancient tool dated to be 6,000 years old, but even more…See More
Monday
tjdavis posted a video

Inside Texas HOMELESS HELL – Even Cops Don't Dare Step In! - Documentary

In this powerful documentary, we explore the escalating Texas homeless crisis 2025, where cities and rural areas alike are witnessing a disturbing rise in th...
Monday

© 2025   Created by truth.   Powered by

Badges  |  Report an Issue  |  Terms of Service

content and site copyright 12160.info 2007-2019 - all rights reserved. unless otherwise noted