Chinese Adware Fireball The Latest Malware to Infect Millions

Security firm CheckPoint, that warned the world about the malware WannaCry, discovered the latest Chinese adware Fireball. While the world is still recuperating from WannaCry that infected computers and Judy that affected Android devices, Fireball hijacks a browser to change the default search engine settings.

Since Friday, when the adware was first detected, Fireball has infected over 250 million PCs worldwide, with the majority of the users being either in India or Brazil. Only a fraction of the victims, around 5.5 million are in the US while India and Brazil saw 25 million infected machines each. The malware can also be found in 20% of corporate networks.

According to CheckPoint, Fireball manipulates the victim’s browsers and turns their search engines and home pages into fake search engines. These fake search engines include tracking pixels which can be used to collect the user’s private information, remotely run any code, or perform random tasks on any infected system.

The malware is run by Rafotech and currently can install plugins and additional configurations to boost advertisements as well as distribute other additional malware. So far there has been no breach reported and while the adware can do a lot of damage, it cannot be called illegal. As stated by CheckPoint many companies provide free services/software and make profits by harvesting data or presenting advertisements. But once a client agrees to install the features of any software, it can no longer be labeled as malicious intent on behalf of the provider.

To check if your PC has been infected by this malware, open your web browser and check if the home page was set by you and if you are able to modify it. If your computer is infected remove the adware by uninstalling the application from your system.