Trojan malware that generates revenue by selling fraudulently generated clicks for advertisement views on websites uses small businesses’ machines as part of large botnets. The malware is spread by unscrupulous online advertising companies, says cybersecurity multinational Kaspersky Lab security expert Sergey Yunakovsky.

Click Counts

The Trojan’s authors compromise computers with the malware, which generates fake views and clicks for advertisements, making a profit for the malware’s authors. The Magala Trojan clicker malware imitates a user’s click on a particular webpage, boosting advertisement click counts. The main victims are those paying for the advertisements, typically small enterprise owners dealing with fraudulent advertisers.

Contextual online advertising is a lifesaver for small enterprises that are usually unable to promote their products and services or increase potential customer awareness in other ways. The most common way to build a channel of supply and communication for these organisations is to buy advertisements from legal advertising companies, he explains.

“However, if the advertiser is unscrupulous, small companies will lose money paid and customers simply will not see the advertisement. “This is exactly what happens with the Magala botnet. Criminals infect victims’ computers with the Trojan, generate fake advertisement views and make up to $350 from each infected machine.”

The Magala infection vector is quite simple – it propagates computers through compromised websites and discreetly installs its required adware. Magala then contacts the remote server and requests a list of search queries for click counts that need to be boosted. Using this list, the programme begins to send search queries and click on each of the first ten links in the search results, with an interval of ten seconds between clicks.

According to Kaspersky Lab’s researchers, an average cost per click (CPC) in a campaign like this is $0.07. The cost per thousand comes to $2.2. Ideally, a botnet cons ten 10 website addresses from each search result, and performing 500 search requests with no overlaps in the search results, could mean the virus writer earns up to $350 from each infected computer.

Robust Security

To reduce the risk of infection, users are advised to use robust security solutions and ensure they keep all software up to date and run a system scan to check for possible infections regularly. “Trying to cut their costs, small businesses go for lower-cost options, but spoil their advertising efforts. “The success of Magala is another wake-up call for users to make the most of solid security solutions and keep all their software updated in order to not fall victim to cybercriminals. “It is better to choose trusted partners than try to cut costs and rely on unverified parties,”concludes Yunakovsky.