Trend Micro Researchers have reported that within several hours of the cross-border incident, search results related to the subject of the clash had been poisoned by scammers. Hijacks were detected for both English and Korean languages. The hijacked search results direct users, depending on browser to a fake ActiveX control or a Flash Player update, which then uses a fake antivirus threat, to try to convince the user that their PC has been infected and that they need to buy bogus antivirus software to remove it.
The fake antivirus variant seen in this attack is now detected as TROJ_FAKEAV.SMRY and that the company was already blocking the sites hosting the malicious files.
News outlets all over the world are talking about the recent cross-border clash between North and South Korea. The shelling, one of the worst incidents between the two countries in years, is naturally being used by cybercriminals behind fake antivirus malware. Within hours of the incident, certain Korea-related search terms have already been poisoned.
