EU cookie law and fake Chrome extensions
When a website is serving up malware to unsuspecting visitors, its often not too hard to find the culprit. In some cases however, it takes a bit more digging. When visiting a (not named on request) specific website, youre presented with the following message:
 | ||
| Your browser contains MALWARE. You have to install Chrome Malware Removal tool |
After some digging on the site, nothing was suspicious at first sight. However... It did have a EU cookie law pop-up/consent:
The script behind it is as follows:
... Which contains:
Both scripts contain the warning message and a redirect to the Google Chrome store:
lang = en;
var msg = Your browser contains MALWARE. You have to install Chrome Malware Removal tool.;
if (lang == es) msg = "Su navegador contiene malware. Usted tiene que instalar la herramienta de eliminaci�n de malware Chrome.";
if (lang == it) msg = "Il tuo browser contiene malware. � necessario installare strumento di rimozione malware Chrome.";
if (lang == fr) msg = "Votre navigateur contient MALWARE. Vous devez installer loutil de suppression de logiciels malveillants Chrome.";
if (lang == pt) msg = "Seu navegador cont�m malware. Voc� tem que instalar o Ferramenta de remo��o Chrome Malware.";
if (lang == de) msg = "Ihr Browser enth�lt MALWARE. Sie m�ssen Chrome Malware Removal Tool zu installieren.";
if (lang == ru) msg = "??? ??????? ???????? ??????????? ???. ?? ?????? ?????????? ?????????? ??? ?????????? ???????????? ????.";
if (lang == gr) msg = "?? ????????? ?????????? ??? ???????? ????????? ?????????. ?? ?????? ?? ????????????? ?? Chrome Malware ???????? ?????????.";
You can find both scripts on Pastebin here and here.
 |
| Chrome Malware Removal Tool |
At time of writing, it has over 22,000 users. You can find the malicious extension here.
UPDATE 27/07: the malicious extension has now been removed from the Chrome store.
To remove an extension from Chrome:
It is not clear whether the site offering the cookie consent script is hacked, or is in on the ploy.
You can find indicators (for what its worth) as always on the AlienVault OTX.
Conclusion
Stay clear from scripts offered by 3rd party EU cookie consent websites and rather create your own pop-up. A trustworthy site to create this for example is cookie-script.
As always when managing a website, keep your CMS (if any) updated as well as any plugins that may be running.
You can find more tips on how to prevent, find (and remove) malicious scripts on your website here.
download file now