{“lastseen”:”2025-08-07T20:04:40″,”description”:”As the use of age verification to access adult websites increases in various countries around the world, shady websites with adult content have started a timely malware-fueled campaign to promote links to their own websites.\\n\\nDuring our daily rounds on Facebook, looking for the latest scams, we noticed something odd about some posts pointing to adult websites. We found that several of the sites promoted in this way were hosted on blogspot[.]com, and that these sites linked to other similar sites.\\n\\nHere’s one example:\\n\\n\\n\\nMost of these sites promise the visitor explicit pictures of celebrities, most of which will undoubtedly turn out to be generated by Artificial Intelligence (AI).\\n\\nThis in itself is not uncommon. However, what did stand out was that a few of the Facebook posts had a lot of Likes. Most people don\u2019t like that type of content on Facebook since everyone can see who the Likes are from.\\n\\n\\n\\nA high number of Likes for a post is great for the accounts posting these links, because when a Facebook profile or post gets more Likes it is more likely to show up in people’s feeds, which is basically more advertising for the same money. \\n\\nSo, how do the posts get these Likes?\\n\\nIt turns out the criminals use a Trojan to promote their posts and profiles. When clicking through links displayed on the adult sites some\u2014selected-visitors will download a Scalable Vector Graphics (SVG) image file. So while surfing from one of these sites to the next one, sometimes, not always, it triggers a download.\\n\\nNow, the cybercriminals are banking on the fact that SVG is not a filetype that will set off an alarm for most people, given that most people see it as an image file. But SVG files are not always simply image files.They are written in XML, and this allows them to contain HTML and Javascript code, which means that the cybercriminals can use them to get up to no good.\\n\\nHere is the one provided by the adult sites:\\n\\n\\n\\nDespite the heavy obfuscation of the second part of the script, for anyone able to read the code it is pretty clear this file is up to no good. In fact, it actually downloads another malicious javascript file, but it was hard to figure out which one.\\n\\nBecause the code in the SVG file uses a technique called \u201chybrid JSFuck\u201d (how fitting) to hide its intentions we immediately assumed that it was malicious. From the easier to read parts of the script we can deduct that the script downloads and executes a malicious script from the domain crhammerstein[.]de, which was blocked by Malwarebytes.\\n\\n![Malwarebytes blocks flan.hammerstein\\\\[.\\\\]de](https:\/\/www.malwarebytes.com\/wp-content\/uploads\/sites\/2\/2025\/08\/blocked_domain.png)\\n\\nJSFuck is a form of obfuscation that encodes JavaScript using only six characters: \u201c[ ] ( ) ! +\u201d. There are several online deobfuscators available for pure JSFuck obfuscation, but the criminals used a hybrid method by adding the String.fromCharCode elements which is not that easy to unravel.\\n\\nOpening the SVG file opens an empty Edge tab titled Process Monitor. This happens because SVG files on Windows are opened by Edge, even if the user has another browser set as their default.\\n\\n\\n\\nIn the end we managed to figure out that the downloaded script was another javascript, detected as Trojan.JS.Likejack. This Trojan, also written in Javascript silently clicks a ‘Like’ button for a Facebook page without the user\u2019s knowledge or consent, in this case the adult posts we found above. The user will have to be logged in on Facebook for this to work, but we know many people keep Facebook open for easy access.\\n\\nOnce we knew how this campaign worked, we found a huge amount of blogspot[.]com pages involved in this campaign:\\n\\n\\n\\n## Conclusion\\n\\nNow that governments are imposing age verification upon adult sites that play by the rules, they are driving those interested in that type of content into the arms of those that don\u2019t care about the rules, even to the extent that they are willing to deploy Trojans to get visitors to their sites.\\n\\nAn alternative is that those trying to access content use a VPN to visit the sites from locations that don\u2019t impose these restrictions. Given those options we would obviously recommend using a VPN.\\n\\nTo be protected against this type of campaigns, it’s worth considering using real-time malware protection. Malwarebytes blocks the domains associated with this campaign.\\n\\n* * *\\n\\n**We don\u2019t just report on threats\u2014we remove them**\\n\\nCybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.”,”published”:”2025-08-07T19:23:06″,”modified”:”2025-08-07T19:23:06″,”type”:”malwarebytes”,”title”:”Adult sites trick users into Liking Facebook posts using a clickjack Trojan”,”source”:””,”references”:””,”id”:”MALWAREBYTES:3B99250D5CF437CF2B7FE800AB8366E2″,”bulletinFamily”:”blog”,”cwe”:null,”cvelist”:[],”sourceData”:””,”sourceHref”:””,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.malwarebytes.com\/blog\/news\/2025\/08\/adult-sites-trick-users-into-liking-facebook-posts-using-a-clickjack-trojan”,”category_name”:”News”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-08-07T20:04:40″,”description”:”As the use of age verification to access adult websites increases in various countries around the world, shady websites with adult content have started a…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[6,8,12,115,13,33,7,11,5],"class_list":["post-10084","post","type-post","status-publish","format-standard","hentry","category-category_news","tag-cve","tag-cvss","tag-exploit","tag-malwarebytes","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n