We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
78,797 News Articles

Trojan hiding in fake Google page

Don't download the toolbar

In an attempt to lure users to download a Trojan backdoor, scammers have set up an exact copy of the download page for Google’s Toolbar plug-in.

Reported by security outfit Surfcontrol, some versions of the scam even spoof the correct Google Toolbar web address for Internet Explorer, using Google’s own redirection service in an attempt to hide the real, non-Google address.

The Trojan itself - W32.Ranky.FW - is designed to turn the PC into a bot zombie, and is spread using the conventional technique of asking recipients of a spam email to follow an embedded link.

According to Surfcontrol, the version detected by the company fails because of poor programming of defective compilation, but it remains a proof-of-concept in how to attack users using a simple combination of convincing elements.

Outwardly simple, the scam has a clever combination of tricks. Although using parts of established websites is standard in phishing scams, it is relatively unusual to go to the length of reproducing en entire page precisely, in combination with a convincingly-spoofed web address.

The fact that the spammed email appears to come from Google could convince recipients to follow the link.

Assuming that a re-engineered version appears - highly likely - once infected, users will notice nothing untoward, although their PCs will have become part of a bot-controlled network.

Google has been attacked in similar way before. Last September, scammers faked the Google search page itself in order to aid the spread of a worm.

More recently, a Trojan attacked the company’s adsense advertisements, replacing them, in-browser, with fake ones on any PC infected with the malware.


IDG UK Sites

Android One vs Android Silver vs Google Nexus: What is the difference?

IDG UK Sites

Apple updates MacBook Pro line-up: Price cuts & spec boosts for 6 MacBook Pro models

IDG UK Sites

Long live the internet fridge: the Internet of Things is coming

IDG UK Sites

How Prometheus' colourist Juan Ignacio Cabrera gave a tense, edgy feel to Chosen