New Fake AV Pages

This report describes an active SEO-poisoning campaign that redirects search-engine traffic and compromised websites to newly observed fake AV landing pages (hosted e.g. on porntube-nowx.com). The pages use compact inline JavaScript and have replaced or supplemented earlier Java/Flash exploit chains; the associated malicious executable is detected by 10 of 40 antivirus engines, indicating active malware distribution via compromised sites and search-result manipulation.