If Equifax thought the resignation of its CEO would be the beginning of the end of its catastrophic security debacle, it was sorely mistaken. This week has seen it attacked again, ultimately redirecting visitors to fake Flash Player updates and malware. It wasn’t the only one either, as TransUnion’s Central American website began doing the same this week.
Although there have been many large hacks over the past few years, the Equifax one was easily one of the worst. Affecting more than 145 million Americans and severely compromising the identity of hundreds of thousands, it left the majority of the country vulnerable to fraud. But it appears as if the Equifax security woes are far from over.
When security researcher, Randy Abrams attempted to visit the Equifax site to check some information on his credit report, he found himself redirected to a malicious URL which claimed his Flash players was out of date. That is a familiar scam message to anyone who has been on the internet for long enough, but it was a surprise to see the scam affect Equifax’s site so soon after it was breached earlier.
As Ars Technica pointed out, such campaigns are often a flash in the pan, but not in this instance. The Equifax site continued to redirect the discoverer to a nefarious alternative site for several attempts.
What is even more worrisome about this, is that people affected by the Equifax hack — as Abrams was — will visit its site to learn more or to mitigate problems it might cause and will be faced with yet another security threat. Fortunately, at the time of writing, it appears to have been fixed, though the resource the previously infected link was supposed to send visitors to is “down for maintenance.”
It appears, too, that the Equifax hack has emboldened hackers to target other credit check agencies too. In a separate incident, the same sort of malicious, faux Flash Player update demands was found on the TransUnionCentroAmerica.com website, Ars Technica reported. Although more sporadic than the Equifax attack, links on its site sent people to malicious pages suggesting they install an update, only to instead download malware.
In some cases, the download would deliver an exploit kit that would try to infect further parts of the browser or system.
TransUnion is said to be aware of the issue and claims to have fixed it. It is also said to be looking into its other online properties to make sure the nefarious links cannot be found elsewhere on its online services.
For those still concerned about your Equifax data, we have a guide on how to secure your information. It’s also worth considering enacting a credit freeze.
