I was browsing the web with my Android phone and I started getting notifications that my phone had 7 viruses ande would shut down unless I installed an app called DFNDR antivirus on the Play store.
I could see from the reviews of the DFNDR app that many users were also being brought to the Google Play store from the fake virus warnings.
Looking at the source code of the website I had been browsing showed a script hosted on Amazon's Cloudfront that had fingerprinted my Android device and served the fake virus warnings through push notifications.
The website also downloaded a malicious app to my phone disquised as an AdBlock app.
Doing a web search using a portion of the scripts code led to the discovery of over 170 websites infected with this malicious Cloudfront script.
I uploaded the Cloudfront script to URL Scan IO and was able to download a screenshot of the malicious Cloudfront script advertising the fake AdBlock.apk
Hello Lisa,
We are glad to help you.
Please visit this Contact AVG Support - AVG Phone Number, and Chat Support? link and select "Technical Support" tab.
For "Are you currently using any paid/trial AVG products?" question, click on "Yes".
Please select operating system as "Android" and fill in other requested details.
Finally, click on "request answer via email" which will submit a ticket to our mobile team.
Please keep checking your emails regularly in order to know the status.
Thank you.
Hello Lisa,
We are glad to help you.
Please visit this Contact AVG Support - AVG Phone Number, and Chat Support? link and select "Technical Support" tab.
For "Are you currently using any paid/trial AVG products?" question, click on "Yes".
Please select operating system as "Android" and fill in other requested details.
Finally, click on "request answer via email" which will submit a ticket to our mobile team.
Please keep checking your emails regularly in order to know the status.
Thank you.
Here is just a very small sample of the hundreds of websites infected by this malvertising script:
tvshows4mobile(.)com
freehottip(.)com
www.dlmania(.)com
hdmp4mania1(.)net
streamcr7(.)com
123moviesfun(.)is
downace(.)com
watchmoviestream(.)me
customsdutyfree(.)com
allsp(.)ch
www(.)rarbgtorrent(.)com
cmacapps(.)com
speed-new(.)com
blogqpot(.)com
www(.)themetalup(.)com
cutewallpaper(.)org
o2tvseries(.)com
music(.)com(.)bd
manillenials(.)com
luchoedu(.)org
bosscast(.)net
kingdesi(.)com
www.legendofkorra(.)tv
deseneledublate(.)com
repack-games(.)com
amongushacks(.)com
wallpapersaccess(.)com
www.macappstores(.)com
softnspot.blogspot(.)com
btorrent(.)xyz
www(.)frkmusicx(.)com
www.()books-share(.)com
dbanimes(.)com
downloadpc-software.blogspot(.)com
apunkagameslinks.blogspot(.)com
naijatunez(.)com
Thank you for your post, Lisa.
Please let us know whether you have any concerns related with AVG?
If yes, please let us know the AVG product which you've installed on your PC/mobiles and explain your queries with relevant screenshots (If any).