Malware on Airtel Smartbytes page

[Sushubh]

Be careful while opening Airtel Smartbytes! : india

Tried it. Can confirm.

 

[Deleted member 63558]

It's a very old malware they have. I have noticed it like 1 or 2 year back.

 

[Sushubh]

Wow just wow ?

 

[amish]

Can anyone check this?

My AV caught error when browsing ICICI bank yesterday.

(Its just phishing so probably harmless to access. But do not give any details and be careful)

https://pdf.icicibank.com/1266161/NSG7.html

AV result (clamav)
NSG7.html: Sanesecurity.Phishing.Bank.3279.UNOFFICIAL FOUND

 

[Sushubh]

i see blank page on that link.

 

[Sushubh]

lots of code though.


Source

 

---

[amish]

Yes lots of code.. but does ur AV detect anything?

Could be the sanesecurity definitions that I use causing false positive.

 

[Sushubh]

No response from Windows Defender.

 

[Smh]

Nothing from VirusTotal

 

[amish]

Yes must be false positive.

 

[sharan_ke]

I have started this topic on reddit with the link given on the very first post of this thread.

It redirected me into a series of spam and malware websites (that's Airtel's fault, it seems). Half of which it was undetected by Virus Total. Only one or two websites had reported as malware and phishing websites, claimed by VT. Just a mixture of malware-cum-phishing website forced redirects (mostly websites with .win domain). There's also a YouTube video to show the same:


Source

 

[sharan_ke]

Bump... is anyone there?

 

[Deleted member 63558]

I have started this topic on reddit with the link given on the very first post of this thread.

It redirected me into a series of spam and malware websites (that's Airtel's fault, it seems). Half of which it was undetected by Virus Total. Only one or two websites had reported as malware and phishing websites, claimed by VT. Just a mixture of malware-cum-phishing website forced redirects (mostly websites with .win domain). There's also a YouTube video to show the same:


Source

That is very well known but nothing you can't do in this case.

That's not malware in your phone, that's the pop script on the Airtel's Smartbyte Page.

 

[sharan_ke]

Sorry for replying such an old post, but when I view the source of Airtel Smartbytes website (which I used to check available data balance), it was injected with the adware s3.amazonaws.com. Source link is given below (adware link is on the 50th line):

view-source:122.160.230.125:8080/gbod/#

That's why it got redirected to such an adware upon going back.