Zemot Malvertising

Google has confirmed that their ad technology foundation to create, transact, and manage digital advertising for the world’s buyers, creators and sellers; has been exploited to deliver malicious advertisements to millions of internet users that could install malware on a user’s computer.

Malvertising (Malware Advertising) is nothing new.

Malicious advertisements lead users to websites containing Nuclear exploit kit, which looks for unpatched versions of Adobe Flash Player or Internet Explorer running on victim’s system. If found one, it downloads the Zemot malware, which then communicate it to a remote server and downloads a bunch of other malicious applications.

Update from Malwarebytes blog @ (09/19/14 9:20 AM PT): It appears that the malicious redirection has stopped. Last activity was detected by our honeypots around midnight last night, and nothing else since then. We are still monitoring the situation and will update here if necessary.

Lesson learned: Keep your systems updated, and scan for viruses (McAfee, Symantec, Windows Defender) and malware regularly. You may also want to get an adblocker like adblockplus.