How To Protect Google Chrome, Firefox, Edge, and Yandex from Adrozek Malware Campaign

[XiNFiNiTY]

What does Adrozek malware do?

Adrozek malware modifies web browsers like Chrome, Mozilla, Yandex, and Edge. This means all devices across the world are pretty much at risk because these are the popular browsers. Moreover, the malware is distributed via 159 malicious domains, and each domain hosts 17,300 distinct URLs. These domains are designed to bypass security tools that help detect threats. 

To target browser and alter browser settings Adrozek malware modifies DLL per target browser and adds browser extensions. This helps attackers insert unauthorized ads into a web page and show them over real ads. 

To make it successful, the malware pauses security settings thereby allowing malicious extensions to run without any permissions and hiding in plain site. 

To understand the same, please refer to the screenshot given below:’

 

 

microsoft.com/security/blog 

This is not all, Adrozek also allows attackers to read user credentials thereby exposing all sensitive information. 

Tip: In such a case using a password manager like TweakPass can save your data from being exposed. 

This password manager helps save usernames and passwords in a Secure encrypted Vault and generate complex random passwords. 

Why Adrozek malware?

The main aim of Adrozek malware is to lead users to affiliate pages and serve them malware-inserted ads. Once, this is done the infection is spread silently and malicious browser extensions are added to the infected browser. 

This malware campaign was identified in 2020.

 

Which countries are mostly affected by this virus?

India and western European countries are affected mostly. 

What makes Adrozek different from earlier malware threats?

Unlike other malware infections, this threat gets installed on devices “though drive-by download” and due to this the installer file uses a general format of setup_.exe. When the installer is run a .exe file is dropped with a random file name in a temporary folder, this, in turn, adds the main payload in the Program Files folder. Once this is done the payload might run under the names Audiolava.exe, QuickAudio.exe, or converter.exe.

Since the malware is installed like any other program identifying it by any regular antivirus software is not easy. 

Also, to make sure Adrozek stays for long the malware prevents browsers from being updated with the latest versions. This means to turn off updates hackers add a policy. This additional change makes using an antivirus even more necessary. 

[Silent Watcher]

Avoid unnecessary posts such as 'Thank you', 'Welcome', etc. Such posts will be deleted and user will be warned if it happens again. If caught spamming, the following actions are applicable -

• First time - Warning
• Second time - 5000 Points will be deducted
• Third time - Ban for 7 days
• Fourth time - Permanent Ban

If the post helped you, reward the user by reacting to the post like this -