Fireball Infects 250 Million Web Browsers

Rafotech, a Chinese digital marketer, is said to be behind a massive spread of malware called Fireball that has infected 250 million web browsers including 20 percent of corporate networks.

Check Point Software Technologies claims that this is “possibly the largest infection operation in history.”

“Fireball has two main functions: the ability of running any code on victim computers–downloading any file or malware, and hijacking and manipulating infected users’ web-traffic to generate ad-revenue,” Check Point said. “Currently, Fireball installs plugins and additional configurations to boost its advertisements, but just as easily it can turn into a prominent distributor for any additional malware.”

Rafotech denies any wrongdoing, Check Point said.

However, “Fireball has the ability to spy on victims, perform efficient malware dropping, and execute any malicious code in the infected machines, this creates a massive security flaw in targeted machines and networks,” researchers said.

Infections are usually the result of installation of software such as Deal Wifi, Mustang Browser, Soso Desktop and FVP Imageviewer. It can also be distributed by third-party freeware and spam campaigns.

Source: Threat Post