Chile Earthquake Tragedy Used To Spread Malware

The report documents an SEO-based malware distribution campaign that leverages popular news search results to serve malicious content conditionally (based on referrer, user agent and OS). Victims arriving via Google are redirected or served iframes linking to a counting Russian site, an obfuscated JavaScript payload at 89.248.160.238/page.php?id=46 (blocked by Firefox), affiliate redirects for Mac users, and fake AV pages for IE/Opera users; direct access yields a benign page. The write-up warns users to be cautious of high-ranking search results and antivirus indicators that may be misleading.