Fake Video Codecs Still Going Strong

This report describes a drive-by fake codec/fake AV campaign where victims are served a malicious page (hosted on onlinetubes24.com) that prompts download of "privatetube.onlinetubes24.com/codec.exe". The executable performs fake antivirus scans, attempts to get victims to purchase activation, and communicates with a remote server at 94.23.39.156; VirusTotal shows 20/42 detections for the sample.