A largest Sweden Newspaper website Aftonbladet is found to be serving malicious ads that redirect users to a malicious website serving Fake Antivirus.
Security researcher at Kaspersky said the website was spreading malware not because they got hacked, but because cybercriminals compromised a third-party ads running on the site.
The malicious script used in the malvertising attack checks whether the user is using Internet Explorer browser or not. Only IE users are being redirected to malware website.
The malware page is not exploiting any vulnerabilities but displays a fake virus alert message from Microsoft Security essential that it has detected potential threats in the user's computer and recommends to clean the malware.
Once user click on the picture, it will not clean any viruses, it will download a malicious obfuscated Visual Basic Executable file.
"Large websites often include content from other websites, and if the bad guys compromise any of those websites they can also manipulate the content which is getting included by the large website." researcher said.