Affiliate web-based malware

Paul Baccas Sophos

  download slides (PDF)

For the past year researchers at SophosLabs have been tracking malicious websites with our technology partners and via product-based reporting.

Most web attacks are fairly simple and straightforward in nature, though the components of the attack are arbitrarily complex. However, some attacks are more complex in nature and include the passing of information to 'grey' sites before installing malware. These complex attacks are very reminiscent of the links we would see were we to analyse a revenue-generating/advertising/pop-up network. These affiliate-based links look to all intents and purposes like a 'legitimate' network with the added bonus of delivering malware.

This paper will attempt to show some simple attacks with a more detailed analysis of some affiliate malware delivery systems.


We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.