2:50PM, 13 Oct 2017
Kovter malware being distributed on adult websites
CERT NZ is aware of reports that some visitors to adult websites have been asked to download browser or video player updates that contain malware.
Recent threats
We highlight current cyber security threats in New Zealand, and provide guidance on what to do if they affect you.
What's happening
Systems affected
CERT NZ understands that some visitors to adult websites over the past year have been directed to download software, which claimed to give them access to videos and content. This software is actually advertising fraud malware, known as Kovter. This malicious software is traditionally used in online advertising fraud to generate money by getting people to click on fake adverts.
At this point, CERT NZ understands the reports only indicate Microsoft Windows users are affected. The website operators have resolved the issue so current users will not be affected.
What to do
Prevention
- Always be careful when downloading software from the internet, ensure you only download from known, reputable websites
- Consider using ad blockers in your web browser.
- Consider disabling JavaScript in your web browser. Note that this may degrade some website functionality.
Mitigation
If you think you’ve been affected by this campaign and have downloaded the malware, CERT NZ recommend:
- In some instances, running an antivirus scan will on your system will flag the problem program, and users should remove any programs that are flagged as of concern
- The Kovter malware has been reported as difficult to remove, and in some instances it’s not detected by antivirus programs. For users that remember installing the program and haven’t had it show up in an antivirus scan, CERT NZ recommends that they see an IT specialist to check whether there is malware on the device.
More information
If you’ve been affected by this scam, or require further support, submit a report on our website or contact us on 0800 CERT NZ.
