This morning I received a call from an employee about how his computer had been infected with the ZEUS virus. When a colleague and I went to investigate the employee told us he had googled “Target”, in an attempt to browse to the big box retailer’s website, and that was how his computer was infected. The video below is what happened when he clicked on the first Google AdSense link appearing in the search.

As you can see the moment the employee clicks on the target.com ad his browser is redirected to the malicious website malwares-system.xyz . I was also able to recreate the issue using a separate user account so the issue did not appear to be local to the employee’s user account. Additionally, I attempted to click on other AdSense links and was unable to recreate the problem. At the time the issue appeared to only be affecting the Google AdSense link for target.com. Man, that company can not catch a break! Although, I suppose this is more of a Google AdSense issue.

The website attempts to steal user credentials by asking the user to voluntarily enter them and then prompts the user to call Microsoft’s Help Desk +1-844-813-5760 (TOLL-FREE) for Free Checkup. In addition, the website falsely states the user has 5 minutes to call before their computer’s hard drive is wiped for safety reasons (Figure. 1). My place of employment is primarily an Ubuntu shop so I’m not sure how much help the Microsoft’s Help Desk will be. 😉

Figure. 1

Anyway, this was an easy issue to resolve in the end as simply avoiding the AdSence link prevented the browser redirection to the malicious website. There was no evidence anything malicious was dropped on to the system and since the malware was targeted at Windows I was not too worried about it.  In the end, I more or less wanted to document this event because I believe it to be a rare event to find anything actively malicious on the front page of a google search. Well at least in my experience for whatever that is worth.

Update: It appears that Google has already pulled the AdSence link as it no longer comes up when searching Target. I have to imagine that thousands or hundreds of thousands people probably clicked on that AdSense link in the time it was compromised.