Fireball malware infects 250mn computers worldwide: Check Point

A new malware with roots in China that has infected over 250 million computers worldwide was recently discovered by Check Point threat intelligence and research teams.

The Fireball malware, operated by Beijing-based digital marketing agency Rafotech acts as a browser-hijacker but could become a fully functioning malware downloader under attackers' control.

"It's not technically more advanced than other malware," says Maya Horowitz, threat intelligence group manager at Check Point. "But it is able to pull any other malware to the infected devices, so it has a maliciousness."

Fireball has two main functionalities: the ability of running any code on victim computers-downloading any file or malware, and hijacking and manipulating infected users' web-traffic to generate ad-revenue. Currently, Fireball installs plug-ins and additional configurations to boost its advertisements, but just as easily it can turn into a prominent distributor for any additional malware.

The greatest hit rates were in India (10.1 percent) and Brazil (9.6 percent). While the US was on the low end at 2.2 percent, it still witnessed 5.5 million hits. Corporate network infections were also greatest in India (43 percent) and Brazil (38 percent); the US represented 10.7 percent of business networks affected.

"We don't know how it got to so many devices worldwide," says Horowitz, adding how Fireball may have spread in ways that haven't been discovered.

Another indicator of the incredibly high infection rate is the popularity of Rafotech's fake search engines. According to Alexa's web traffic data, 14 of these fake search engines are among the top 10,000 websites, with some of them occasionally reaching the top 1,000.

Ironically, although Rafotech doesn't admit it produces browser-hijackers and fake search engines, it does declare itself a successful marketing agency, reaching 300 million users worldwide - coincidentally similar to our number of estimated infections.

To know if you've been hit with Fireball: Open your Web browser and check if your homepage was set by you, if you can modify it, if you can recognize and modify the default search engine, and if you installed all your browser extensions. If the answer is "no" to any of those, it's a sign you may have been hit with the malicious adware.