Recently I have seen a lot of these:
This is not the typical "fake pop up" trying to have you tap on it and redirect you to the Play Store. This pop up actually replaces the tab I'm browsing, and is trying to have me go to the play Store to install one specific app.
Everything in this phone comes from the official Play Store, and the phone is not rooted.
For SEO sake, here are the domains used in this scam:
eu.sustainable-49.xyz samsung.giveaway-deal-com.xyz us.east-85.xyz
Here are a few screenshots:
The text basically says that my phone is infected and I NEED to install those applications, or that I have won something and I need to something (I didn't follow in that case..)
In one case, this leads to this application, which contains this comment (from yesterday):
Hi, thanks for your feedback. We’ve found that some ads/redirected pages may be malicious promotion from unknown channels, slandering us on purpose. Would you please be so kind that next time you come across the pop-up ads, please send us the link/spam/redirect pages or a screenshots to our Email: email@example.com. Thanks a million.
I'm not sure whether this is a local attack on my smartphone, ie an app which would somehow mess with Chrome, inject some code in the pages, or an attack on those websites, or a compromised ad network. It's a bit hard to tell exactly when this is happening.
Could you suggest a method to capture this behavior next time it happens so that I can understand why this is happening ?
Here is one example:
1/ click on Google search result 2/ now I am on some domain on forum-actif.net 3/ redirect to android.earix.com 4/ some data containing this url: go.onclasrv.com/afu.php?... 5/ redirect to onclickads.net 6/ us.east-85.xyz -> virus notifications leading to some Play Store App
1/ m.wikipedia.org 2/ orange.com-getprize.net 1/ bfmtv.com (French news TV website) 2/ redirect to eu.sustainable-49.xyz/fr002rd/redirect.html?model=Nexus%205&brand=Google&browser=Chrome
This leads me to think that the attack could be from a malicious app on my smartphone, because there is no way this is happening because of a compromised ad network on wikipedia.org.