Connect with us

Hi, what are you looking for?



Massive Stealthy Malvertising Campaign Uncovered

A stealthy malvertising campaign has been flying under the radar for the last few months, targeting millions of readers visiting popular and mainstream news sites. The campaign is notable for stealth bordering on paranoia from the threat group, probably AdGholas.

A stealthy malvertising campaign has been flying under the radar for the last few months, targeting millions of readers visiting popular and mainstream news sites. The campaign is notable for stealth bordering on paranoia from the threat group, probably AdGholas.

In July 2016, Proofpoint published an analysis of a massive AdGholas malvertising campaign that it described as “using a sophisticated combination of techniques including sophisticated filtering and steganography.” It added that AdGholas had ceased operation following exposure, but “the scale and sophistication of this operation demonstrate the continued evolution and effectiveness of malvertising.”

Now it appears that AdGholas simply changed tactics, and within a couple of months launched a new campaign described in an ESET research paper published yesterday. In a detailed analysis, ESET doesn’t name the threat actors and calls the exploit kit (EK) involved Stegano. Further background information has been provided by Malwarebytes naming the actors as AdGholas, and the EK as Astrum. Stegano and Astrum are just different names for the same EK.

What sets this campaign apart from other and earlier campaigns is the extent of its stealth. When the ad data is first delivered, the campaign uses server-side logic on the potential victim’s returned computer data to decide whether to deliver a malicious banner or a clean banner. If it delivers the malicious version, the code is hidden by steganography: specifically within the parameters controlling the transparency of each pixel. The result is only a minor change to the color tone of the image, invisible to the naked eye. 

Ultimately, the hidden code leads to the Astrum exploit kit — but neither automatically nor necessarily. The malicious code first uses a known Internet Explorer vulnerability CVE-2016-0162 to check for any sign of monitoring or analysis. If it detects a sandbox, or virtualization or certain security products it stops. Otherwise it sets up a one pixel iframe and redirects, via TinyURL, to the EK landing page.

The EK checks for Internet Explorer and loads a Flash file with three encrypted exploits. If it detects a vulnerable Flash version, the relevant exploit is run — otherwise, once again, it stops. If successful, writes ESET in an accompanying overview post, “the bad guys have all they need to download and execute the malware of their choice. Some of the payloads we analyzed include banking trojans, backdoors and spyware, but the victims could end up facing a nasty ransomware attack, for example.”

The two main payloads detected by ESET are Ursnif and Ramnit. Ursnif has modules for stealing email credentials, keylogging, screenshots and a backdoor, and seems to be targeting the corporate sector. Ramnit is financial fraud malware that targets the banking sector.

The scary part of this campaign is that it requires no user interaction at any stage. If the user visits an affected news site with a vulnerable browser and vulnerable Flash (and is in one of the targeted geographical areas) then malware execution could be entirely automatic and unseen. If any of those requirements are not met, then the malicious banner simply remains dormant and its malicious code invisible.

Advertisement. Scroll to continue reading.

The two banners known to ESET are both for apparent security products: Browser Defence (notice the spelling) and Broxu. The spelling fits with the targeted regions. Malwarebytes separately comments, “The interesting aspect about this malvertising campaign is that the US was not one of the targets. Instead we saw Canada, the UK, Australia, Spain, Italy, and Switzerland as the most active geolocations.” Of these, Canada and the UK were the most targeted.

ESET has avoided mentioning the news sites afflicted by the adverts. Disclosure, it says, would not have added any value to the research analysis; rather it could give a false sense of security to users who had not visited those particular sites when “the banners could have appeared on practically any website that displays ads.”

Malwarebytes has been less reticent. “Despite not targeting the US, the latest AdGholas campaign has once again reached epic proportions,” wrote lead malware intelligence analyst Jerome Segura, “and unsuspecting users visiting top trusted portals like Yahoo or MSN (not to mention many top level publishers) were exposed to malvertising and malware if they were not protected.”

Since it is impossible to avoid coming across stealthy malvertising, protection is the only defense. This would include using one of the more secure browsers such as Chrome, Edge or Firefox; not using Flash; and maintaining mainstream and up-to-date anti-virus protection.

As of yesterday, this campaign was still operating. “At the time of posting the campaign still continues,” wrote Segura, “although the major ad networks have been informed and ‘should’ no longer be involved.” But even when this campaign closes, AdGholas will most likely return later with a new campaign and new tricks. “There is no doubt that the adversary is very advanced and has been clever to fly under the radar for long periods of time,” he comments.

Written By

Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join us as we delve into the transformative potential of AI, predictive ChatGPT-like tools and automation to detect and defend against cyberattacks.


As cybersecurity breaches and incidents escalate, the cyber insurance ecosystem is undergoing rapid and transformational change.


Expert Insights

Related Content


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.


As it evolves, web3 will contain and increase all the security issues of web2 – and perhaps add a few more.


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...


Luxury retailer Neiman Marcus Group informed some customers last week that their online accounts had been breached by hackers.


Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.


Satellite TV giant Dish Network confirmed that a recent outage was the result of a cyberattack and admitted that data was stolen.

Artificial Intelligence

The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.


A new study by McAfee and the Center for Strategic and International Studies (CSIS) named a staggering figure as the true annual cost of...