Caution! 250 Million Computers Worldwide Affected By Fireball Malware

Windows, Mac OS and more than 250 million computers across the world have been hit by a massive malware campaign discovered Security researchers.

The malware identified as Fireball is an adware package. Fireball takes the upper hand of victim’s web browsers and turns them into puppets, enabling the criminals to spy on victim’s network traffic and steal their data.

Check Point researchers have traced the operation to a Chinese company, Rafotech. Rafotech offers digital marketing and game apps to 300 million customers.

Fireball can be quickly turned into a large destroyer to result in a significant cyber security incident worldwide though the company is using Fireball to generate revenue by posting advertisements onto the browsers,

Fireball will get to your device when you download other free software programs off the Internet. Once downloaded, the malware installs browser plugins to tamper with the victim’s web browser configurations by replacing the default search engines and home pages with false search engines (trotux.com).

Researchers said, “It’s crucial to keep in mind that when a user installs freeware, additional malware will not immediately drop at the same time.”. “Furthermore, Rafotech might be using other distribution methods, like spreading freeware under false names, buying installs from threat actors or even spam.”

Once the fake search engine redirects the victim’s queries to either Yahoo.com or Google.com, tracking pixels that collect the victim’s information will be activated.

Fireball illegally spies on web traffic of the victim, executing any malicious code on the infected computers. He malware also installs plug-ins, and even carries on efficient malware dropping, creating security loops on targeted systems and networks.

Researchers said, “From a technical approach, Fireball is sophisticating and displays quality evasion techniques such as anti-detection capabilities, a flexible C&C, and multi-layer structure, – it is not junior to a typical malware,”

At present, Fireball adware is spying web traffic to boost its advertisements and gain revenue, and on par, the adware has the distributes additional malware.

Further researchers added, ” one out of five corporations worldwide will be undergoing a major breach according to the estimated infection.”

So it is found that over 250 million computers are infected worldwide, 20 percent includes corporate networks:

• 13.1 million in Indonesia (5.2%)
• 5.5 million in the US (2.2%)
• 25.3 million infections in India (10.1%)
• 24.1 million in Brazil (9.6%)
• 16.1 million in Mexico (6.4%)

“How serious is it? Yes, it can do the worst job, but it can also do much more,” researchers stated. ” Rafotech’s power will cause harm on threat actors.”

How to find that Your Computer is Fireball-Infected?
If you say “NO,” to the below questions, it shows that your computer is infected with Fireball or a similar malware.

Open your web browser and check:

1. Did you set your homepage?
2. Are you able to customize your browser’s homepage?
3. Do you feel familiar with your default search engine and can customize that as well?
4. Do you remember installing all browser extensions?

How to remove Fireball?
You will have to uninstall the respective application from your computer (or use an adware cleaner software) and next restore/reset your browser configurations to default settings.

The best way to prevent such infections is to be precautious when you agree to install.

Pay attention when installing software, since software installers include optional installs. Usually, Opt for custom installation and then de-select anything that seems unfamiliar.