ESET uncovers stealthy Stantinko malware's click fraud prowess

ESET has spotted a malware strain that tricks users into downloading pirated software from dummy torrent sites, and it has so far affected half a million users.

The malware, dubbed Stantinko, has been lurking for the past five years but it has been so adept at changing its form that has been undetected since then.

Researchers say that Stantinko is made up of a bot network. That network is monetised through browser extensions that inject fake ads when browsing the web.

"It allows Stantinko operators to be paid for the traffic they provide to these adverts. We even found users would reach the advertiser's website directly through Stantinko-owned ads," comments ESET malware researcher Matthieu Faou.

When Stantinko is installed it can create fake Facebook accounts, like pictures and pages and add friends. It can also conduct Google searches anonymously.

ESET researchers say that Stantinko uses code that looks legitimate, but hidden code is encrypted in Windows Registry or encrypted in a file.

"It is difficult to get rid of once you have it, as each component service has the ability to reinstall the other in case one of them is deleted from the system. To fully eliminate the problem, the user has to delete both services from their machine at the same time," comments ESET malware researcher Frédéric Vachon.

A key is generated during the initial compromise, which then decrypts the code. Because the command - control server must then launch new components, it's more difficult to uncover until that happens.

Once launched, the malware then installs 'The Safe Surfing' and 'Teddy Protection' browser plugins. While they look legitimate, Stantinko configured them to receive rules for click fraud and ad injection, comments ESET senior malware researcher Marc-Etienne Léveillé.

Once the malware is fully operational, attackers can use plugins to control the infected system. The searches can trawl Joomla and WordPress sites with the aim of conducting brute force attacks.

While it has so far been spotted targeting Russia, Ukraine, Belarus and Kazakhstan, the malware's build is tipped to be a goldmine for click fraud hackers.

The compromised sites can then be sold on the dark web, while its Facebook activities can sell 'likes' to unsuspecting users.

While Stantinko could technically be classed as adware, its activities through internet searches, bots and controlling systems also class it as a dangerous backdoor. Researchers point out that it could be used for other malicious purposes.