Return to Question

Related: Is the Web browser status bar always trustable?

How can Google search change the location in a URL tooltip?

I've always thought you can "hover" over a link to see where it really goes, until today.

A coworker (working from home) searched for "Target" in Google Search (using edge). He clicked the top result, which happened to be an ad, and was redirected to a phishing page posing as Microsoft trying to get him to call a "tech support" number.

I got the same results on a different computer, on a different network. When I hover over the link, both links show "www.target.com" at the bottom, but clicking the ad link takes you to a malware page and the second link (first search result after the ad) takes you to the real Target.com page.

If displaying the wrong URL in the tooltip requires Javascript, how did tech-supportcenter get their Javascript onto the Google search results page?

UPDATE Here's the same results in a virtual machine with a fresh install of Windows, on a different network:

Here's the source for the URL. It looks like it does include the "onmousedown" Javascript as the first question I linked to mentioned. Does Google allow advertisers to display any URL they want for the tooltip?

###Update 06/06/2017### So, it may be a coincidence, but

• The day after visiting this site, an unrecognized charge for "GA Secretary of State" for $350 appeared on my credit card. (Yes, I canceled the card). The malware domain is registered to a guy in Georgia.
• I checked my version of Chrome and found that I was running version 58.0.3029.110 at the time I visited the site, which updated to 59.0.3071.86 today. It looks like version 59 was released yesterday, with several security fixes.
• I ran a malware scan using Malwarebytes, which found "PUP.Optional.GeekBuddy" at HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\EVENLOG\APPLICATION\GEEKBUDDYRSP. This sounds like the kind of thing some fake "tech support" people would want to install. RSP for "Remote Screen Protocol"?

It's a tenuous connection, but now I'm worried I fell for a drive-by exploit by visiting the site. This doesn't really affect the question, but I wanted to bring this up because it sounds like several other people on this forum visited the site. You may want to run a scan as well.

The virtual machine where I visited the site in Internet Explorer doesn't seem to have been affected.

Related: Is the Web browser status bar always trustable?

How can Google search change the location in a URL tooltip?

I've always thought you can "hover" over a link to see where it really goes, until today.

A coworker (working from home) searched for "Target" in Google Search (using edge). He clicked the top result, which happened to be an ad, and was redirected to a phishing page posing as Microsoft trying to get him to call a "tech support" number.

I got the same results on a different computer, on a different network. When I hover over the link, both links show "www.target.com" at the bottom, but clicking the ad link takes you to a malware page and the second link (first search result after the ad) takes you to the real Target.com page.

If displaying the wrong URL in the tooltip requires Javascript, how did tech-supportcenter get their Javascript onto the Google search results page?

UPDATE Here's the same results in a virtual machine with a fresh install of Windows, on a different network:

Here's the source for the URL. It looks like it does include the "onmousedown" Javascript as the first question I linked to mentioned. Does Google allow advertisers to display any URL they want for the tooltip?

Related: Is the Web browser status bar always trustable?

How can Google search change the location in a URL tooltip?

I've always thought you can "hover" over a link to see where it really goes, until today.

A coworker (working from home) searched for "Target" in Google Search (using edge). He clicked the top result, which happened to be an ad, and was redirected to a phishing page posing as Microsoft trying to get him to call a "tech support" number.

I got the same results on a different computer, on a different network. When I hover over the link, both links show "www.target.com" at the bottom, but clicking the ad link takes you to a malware page and the second link (first search result after the ad) takes you to the real Target.com page.

If displaying the wrong URL in the tooltip requires Javascript, how did tech-supportcenter get their Javascript onto the Google search results page?

UPDATE Here's the same results in a virtual machine with a fresh install of Windows, on a different network:

Here's the source for the URL. It looks like it does include the "onmousedown" Javascript as the first question I linked to mentioned. Does Google allow advertisers to display any URL they want for the tooltip?

###Update 06/06/2017### So, it may be a coincidence, but

• The day after visiting this site, an unrecognized charge for "GA Secretary of State" for $350 appeared on my credit card. (Yes, I canceled the card). The malware domain is registered to a guy in Georgia.
• I checked my version of Chrome and found that I was running version 58.0.3029.110 at the time I visited the site, which updated to 59.0.3071.86 today. It looks like version 59 was released yesterday, with several security fixes.
• I ran a malware scan using Malwarebytes, which found "PUP.Optional.GeekBuddy" at HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\EVENLOG\APPLICATION\GEEKBUDDYRSP. This sounds like the kind of thing some fake "tech support" people would want to install. RSP for "Remote Screen Protocol"?

It's a tenuous connection, but now I'm worried I fell for a "drive-by" exploit by visiting the site. This doesn't really affect the question, but I wanted to bring this up because it sounds like several other people on this forum visited the site. You may want to run a scan as well.

The virtual machine where I visited the site in Internet Explorer doesn't seem to have been affected.

Related: Is the Web browser status bar always trustable?

How can Google search change the location in a URL tooltip?

I've always thought you can "hover" over a link to see where it really goes, until today.

A coworker (working from home) searched for "Target" in Google Search (using edge). He clicked the top result, which happened to be an ad, and was redirected to a phishing page posing as Microsoft trying to get him to call a "tech support" number.

I got the same results on a different computer, on a different network. When I hover over the link, both links show "www.target.com" at the bottom, but clicking the ad link takes you to a malware page and the second link (first search result after the ad) takes you to the real Target.com page.

If displaying the wrong URL in the tooltip requires Javascript, how did tech-supportcenter get their Javascript onto the Google search results page?

UPDATE Here's the same results in a virtual machine with a fresh install of Windows, on a different network:

Here's the source for the URL. It looks like it does include the "onmousedown" Javascript as the first question I linked to mentioned. Does Google allow advertisers to display any URL they want for the tooltip?

###Update 06/06/2017### So, it may be a coincidence, but

• The day after visiting this site, an unrecognized charge for "GA Secretary of State" for $350 appeared on my credit card. (Yes, I canceled the card). The malware domain is registered to a guy in Georgia.
• I checked my version of Chrome and found that I was running version 58.0.3029.110 at the time I visited the site, which updated to 59.0.3071.86 today. It looks like version 59 was released yesterday, with several security fixes.
• I ran a malware scan using Malwarebytes, which found "PUP.Optional.GeekBuddy" at HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\EVENLOG\APPLICATION\GEEKBUDDYRSP. This sounds like the kind of thing some fake "tech support" people would want to install. RSP for "Remote Screen Protocol"?

It's a tenuous connection, but now I'm worried I fell for a drive-by exploit by visiting the site. This doesn't really affect the question, but I wanted to bring this up because it sounds like several other people on this forum visited the site. You may want to run a scan as well.

The virtual machine where I visited the site in Internet Explorer doesn't seem to have been affected.

Related: Is the Web browser status bar always trustable?

How can Google search change the location in a URL tooltip?

I've always thought you can "hover" over a link to see where it really goes, until today.

A coworker (working from home) searched for "Target" in Google Search (using edge). He clicked the top result, which happened to be an ad, and was redirected to a phishing page posing as Microsoft trying to get him to call a "tech support" number.

I got the same results on a different computer, on a different network. When I hover over the link, both links show "www.target.com" at the bottom, but clicking the ad link takes you to a malware page and the second link (first search result after the ad) takes you to the real Target.com page.

If displaying the wrong URL in the tooltip requires Javascript, how did tech-supportcenter get their Javascript onto the Google search results page?

UPDATE Here's the same results in a virtual machine with a fresh install of Windows, on a different network:

Here's the source for the URL. It looks like it does include the "onmousedown" Javascript as the first question I linked to mentioned. Does Google allow advertisers to display any URL they want for the tooltip?

###Update 06/06/2017### So, it may be a coincidence, but

• The day after visiting this site, an unrecognized charge for "GA Secretary of State" for $350 appeared on my credit card. (Yes, I canceled the card).
• I checked my version of Chrome and found that I was running version 58.0.3029.110 at the time I visited the site, which updated to 59.0.3071.86 today. It looks like version 59 was released yesterday, with several security fixes.
• I ran a malware scan using Malwarebytes, which found "PUP.Optional.GeekBuddy" at HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\EVENLOG\APPLICATION\GEEKBUDDYRSP. This sounds like the kind of thing some fake "tech support" people would want to install. RSP for "Remote Screen Protocol"?

It's a tenuous connection, but now I'm worried I fell for a "drive-by" exploit by visiting the site. This doesn't really affect the question, but I wanted to bring this up because it sounds like several other people on this forum visited the site. You may want to run a scan as well.

The virtual machine where I visited the site in Internet Explorer doesn't seem to have been affected.

Related: Is the Web browser status bar always trustable?

How can Google search change the location in a URL tooltip?

I've always thought you can "hover" over a link to see where it really goes, until today.

A coworker (working from home) searched for "Target" in Google Search (using edge). He clicked the top result, which happened to be an ad, and was redirected to a phishing page posing as Microsoft trying to get him to call a "tech support" number.

I got the same results on a different computer, on a different network. When I hover over the link, both links show "www.target.com" at the bottom, but clicking the ad link takes you to a malware page and the second link (first search result after the ad) takes you to the real Target.com page.

If displaying the wrong URL in the tooltip requires Javascript, how did tech-supportcenter get their Javascript onto the Google search results page?

UPDATE Here's the same results in a virtual machine with a fresh install of Windows, on a different network:

Here's the source for the URL. It looks like it does include the "onmousedown" Javascript as the first question I linked to mentioned. Does Google allow advertisers to display any URL they want for the tooltip?

###Update 06/06/2017### So, it may be a coincidence, but

• The day after visiting this site, an unrecognized charge for "GA Secretary of State" for $350 appeared on my credit card. (Yes, I canceled the card). The malware domain is registered to a guy in Georgia.
• I checked my version of Chrome and found that I was running version 58.0.3029.110 at the time I visited the site, which updated to 59.0.3071.86 today. It looks like version 59 was released yesterday, with several security fixes.
• I ran a malware scan using Malwarebytes, which found "PUP.Optional.GeekBuddy" at HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\EVENLOG\APPLICATION\GEEKBUDDYRSP. This sounds like the kind of thing some fake "tech support" people would want to install. RSP for "Remote Screen Protocol"?

It's a tenuous connection, but now I'm worried I fell for a "drive-by" exploit by visiting the site. This doesn't really affect the question, but I wanted to bring this up because it sounds like several other people on this forum visited the site. You may want to run a scan as well.

The virtual machine where I visited the site in Internet Explorer doesn't seem to have been affected.