SecurityProNews Directory: A Directory For All Things Security

Confirmed: Yahoo Ads Were Spreading Malware To Users

Yahoo confirmed that it was running advertisements that were spreading malware on some of its sites. While this is apparently in the past now, the company acknowledged and confirmed reports that this took place on Friday.

IB-Times (published at Yahoo News) shares a statement from Yahoo:

In a statement, Yahoo’s spokesperson said: “On Friday, January 3 on our European sites, we served some advertisements that did not meet our editorial guidelines, specifically they spread malware.”

The malware did not affect users of Apple Mac computers or mobile devices, Yahoo confirmed.

The issue was originally reported by researchers at Fox-IT, which operates the ProtACT shared security operations center, which monitors the networks of its clients for malicious activity. The firm said that on Friday, it detected and investigated the infection of clients after they visited

“Clients visiting received advertisements served by Some of the advertisements are malicious,” it said, adding that “upon visiting the malicious advertisements users [got] redirected to a ‘Magnitude’ exploit kit via a HTTP redirect to seemingly random subdomains.”

The malicious ads, according to Fox-IT, were hosted on the following domains: (, (,, and

The redirects pointed to:,, and others. Each domain was served from a single IP address ( hosted in the Netherlands, the firm said, estimating that visits to the malicious site reached 300,000 per hour.

“It is unclear which specific group is behind this attack, but the attackers are clearly financially motivated and seem to offer services to other actors,” said Fox-IT. “The exploit kit bears similarities to the one used in the brief infection of in October 2013.”

This is one issue that Yahoo’s PR department didn’t need following a much publicized Yahoo Mail outage debacle last month, which CEO Marissa Mayer had to publicly apologize for.

Mayer will speak at the Consumer Electronics Show in Las Vegas on Tuesday.

Image: Yahoo


Chris Crum
About Chris Crum
Chris Crum is a staff writer for SecurityProNews and WebProNews.

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>