Cybercriminals exploit Java 0-day fears to serve malware

With all the recent Java zero-day vulnerabilities being exploited in the wild and Internet news outlets heavily covering the development of the situation, many users will look for updates for the popular computing platform.

As expected, malware peddlers were quick to exploit this development and have already set up compromised websites that supposedly offer the latest update (7u11) for download:

“The fake update in question is javaupdate11.jar, which contains javaupdate11.class that downloads and executes malicious files up1.exe and up2.exe,” Trend Micro researchers shared.

The two files are the Andromeda backdoor, which connects to a remote server and makes it possible for the attacker to take control of the infected system, and a spyware variant that logs users’ keystrokes and accesses other websites to download additional malware (in this case a faulty piece of ransomware).

The researchers warn users who plan to update their Java to make sure to get it from a reliable source (Oracle’s website) and not third-party sites.

“The use of fake software updates is an old social engineering tactic. This is not the first time that cybercriminals took advantage of software updates,” they concluded.

In fact, only a week ago they have been spotted exploiting the fact that Google released the latest version of its Chrome browser to saddle users with malware.