Google’s Doubleclick ad servers exposed millions of computers to malware

Last night, researchers at Malwarebytes noticed strange behaviour on sites like Last.fm, The Times of Israel and The Jerusalem Post. Ads on the sites were being unusually aggressive, setting off anti-virus warnings and raising flags in a number of Malwarebytes systems. After some digging, researcher Jerome Segura realized the problem was coming from Google’s DoubleClick ad servers and the popular Zedo ad agency. Together, they were serving up malicious ads designed to spread the recently identified Zemot malware. A Google representative has confirmed the breach, saying our team is aware of this and has taken steps to shut this down.

Malware served through ad units (or malvertising) is nothing new, but this incident is notable because of the unusually broad reach of the attack. It was active but not too visible for a number of weeks until we started seeing popular sites getting flagged in our honeypots, Segura says. That’s when we thought, something is going on. The first impressions came in late August, and by now millions of computers have likely been exposed to Zemot, although only those with outdated antivirus protection were actually infected — via redwolf.newsvine.com