Ankura CTIX FLASH Update - November 10, 2023

Malware Activity

New Malvertising Campaign Spotted Disguising as Legitimate Windows News Portal

A new malvertising campaign has been identified disguising as the legitimate Windows news portal "WindowsReport[.]com" to distribute a malicious installer for the "CPU-Z" processor tool. The campaign is noted to be a part of a large-scale malvertising campaign that has been observed targeting other applications, such as Notepad++, Citrix, and VNC Viewer. Researchers identified a malicious ad at the top of provided search results when searching for "cpu-z", which is a common utility for Windows end-users for troubleshooting their machine. If clicked, the malicious ad redirects the user to a domain impersonating WindowsReport[.]com and uses content directly from the legitimate portal. Researchers emphasized that several additional domains are hosted on the same IP address that are also used in malvertising campaigns. The campaign's payload is a digitally signed