Bad adverts in Bing leading end-users to Malware downloads first popped up on our radar on the 16th of September, and we covered them again on the 19th. Well, they’re back again – this time promoting fake Firefox downloads whose ads are displayed when searching for….wait for it….”Firefox download”:
Click to Enlarge
Click to Enlarge
You’ll notice they missed a trick there, advertising Firefox 6 instead of the freshly minted Firefox 7. The URLs involved are hotelcrystalpark(dot)com/firefox_1 and firefox(dot)dl-labs(dot)com, with the rogue downloads being hosted at the dl-labs URL. VirusTotal score currently gives us 6/43, with VIPRE detecting this as Trojan.Win32.Kryptik.cqw (v).
Christopher Boyd (Thanks to Matthew for finding this one).