MacOSDefender or MacOSDefender.app is malicious application for MacOS, that takes over search and homepage settings in Safari, Google Chrome or Mozilla Firefox. While searching for something, users can see multiple redirects, for example: goto-searchitnow.global.ssl.fastly.net -> my-search.com -> searchroute-1560352588.us-west-2.elb.amazonaws.com -> alphashoppers.co. Some of this web addresses figured in our previous articles, from what we can make a conclusion, that those hijackers have similar roots and, probably, one team of developers.
There are a lot of hijackers, that install Search.yahoo.com (Us.yhs4.search.yahoo.com) as default search engine and homepage. Search engines fight for the market and different companies use various ways to distribute their product. Along with their own browser add-ons Yahoo is partnering with thousands of software developers and webmasters, allowing them to earn by driving traffic and customers to search.yahoo.com website. Developers earn on user clicks on ads inside Yahoo Search or just per each installation of Yahoo search products in browsers.
SafeFinder is browser extension that is installed in 3 major browsers (Google Chrome, Mozilla Firefox and Internet Explorer). SafeFinder replaces default search and homepage of all your browsers to search.safefinder.com. Even if you remove SafeFinder from Control Panel and extensions from browsers these settings will remain unchanged.
Search.yourmapsnow.com or YourMapsNow is misleading browser hijacker, that replaces default search engine and homepage in Safari, Google Chrome or Mozilla Firefox on Windows or Mac. Often, it is accompanied with browser extension or application called “Your Maps Now”. This add-on sneaks in browsers and takes control over main browser settings. Of course, it installs without user permission using the deceptive tactic. After installation, user search queries are redirected to query.yourmapsnow.com and then to search.yahoo.com. This allows the hijacker to collect private browser data and share it with advertising companies. The homepage also changes to Search.yourmapsnow.com and, besides search, provides quick links to main map resources such as Google Maps and Bing Maps. Page looks similar to normal search engine page, and some users don’t even see the difference until they start searching for something.
Ads and redirects from Laubeyrietechnology.com in Google Chrome or Mozilla Firefox are caused by installed browser extensions. As a result, users constantly see advertising blocks before and after Google search results. After clicking on links in this ads, they are redirected to the aforementioned domain. Currently, there is a list of certain add-ons, known to be the source of infection, however, malware developers may extend distribution by purchasing more and more Chrome and Firefox extensions projects. Ads and redirects appear soon after updating such e This is a dangerous and perfidious way of spreading the infection, as it hits unsuspecting owners of previously good and safe add-ons.