How can scammers inject pop-ups onto target computers?

Question

My grandfather recently fell for a telephone scam. I won't go into details into how the scam worked; it's sufficient to say that he sent them over $2000 worth of iTunes gift card codes.

The scammers walked him through installing "TeamViewer" then "helping" him with his computer (a Mac mini). "TeamViewer" is in quotes because I don't know for sure what they actually got him to install. It could have been a legitimate copy of TeamViewer, or it could have been a version of TeamViewer laced with malware. Since I don't know if his computer has been infected with anything, I'm going to have him mail the Mac mini to me. I intend to nuke it from orbit; it's the only way to be sure. I'll set him up with a non-admin account and manage it remotely.

Here's where the story takes an odd turn. The scammers called him today and requested that he turn on TeamViewer so that they could continue to "help" him. My grandfather said no, and the scammer belligerently said that he would block/disconnect his computer. I'm unsure of the details (since I couldn't see the computer), but my grandfather said that big messages appeared on his computer saying that his computer had a virus and that he needed to call a number. When he called that number, it was the scammer (no surprise). The warnings came repeatedly over the next few hours.

Here's my question: How were the scammers able to remotely trigger warning messages on his computer? If they had access, why did they need my grandfather to enable TeamViewer? If you still had access, it would be much more productive to just access it at 3am when he's asleep. If they didn't have access, how could they push the ads?

I will mostly likely receive the computer in the mail within 48 hours. Once I have it I will have a small window in which to examine it before I need to initiate the nuke. Are there any tests that I can run to check for malware?

Answer 1

To bad that your grandfather got scammed by those bastards, anyway scam is known as "Teamviewer scam", and since stammers had an access to the computer, probably they installed trojan for later deception which will bring them more money.

Second scenario according to BleepingComputer is:

In some cases, parts of the TeamViewer app has even been embedded in malware directly, as to simplify the process of stealing data via a legitimate communications channel, disguising the data theft operations under TeamViewer traffic.

After all in case like your grandfather's it is good to do next steps:

1. Call Your Financial Institution and Tell Them What Happened

Chances are, if you bank with a larger well-known bank, they will already have experience with this type of scam and will tell you exactly what they can do in terms of putting a security alert on your account, dealing with fraudulent charges, etc.

DO NOT WAIT TO CALL YOUR BANK, tell them as soon as possible. If you wait too long then they might not be able to help you with the bogus charges.

They will likely put a fraud alert on your accounts and issue you a new card. If they don't offer to do this, INSIST on it.

2. Isolate and Quarantine Your Computer

Unplug the affected computer's network cord and turn off its wireless connection.

If you installed the remote admin tool as they directed, then they could be rooting around on your computer accessing your personal files, even after the phone call is over. They could also install keylogging malware to record your passwords as you access your bank and other accounts.

Once you've disconnected the computer from the network, read our article: I've been Hacked, Now What? for information on how to backup your data, wipe its disks, and reload your computer. If you're not comfortable doing this on your own, consider taking your computer to a reputable local computer repair technician.

3. Monitor ALL of Your Accounts

You may want to consider signing up with a credit monitoring / identity theft protection service so that you can be alerted if and when scammers try to use your personal or financial information again.

4. Alert and Educate Your Friends and Family About This Scam

Even though this scam is affecting millions of people, there are surprisingly a lot of people who haven't heard about it and are still falling victim to it. Spread the word and share this and related articles with your friends and family. Educating people is the key to stopping this type of scam.

5. Change Your Passwords

After you ensure that your system is free of malware and keylogging software, change all your important passwords.

Make sure to choose strong passwords when creating new ones.

Source

Answer 2

Malvertising, as well as phone calls, are all ways scammers use to get someone to download a remote access program like TeamViewer, Anydesk, etc. Once the scammer has connected in, they can do or install whatever they want. They got their foot in the door. Its rather unlikely that there was a trojan on there beforehand, though it is possible.

Perhaps the scammer installed a low-sophistication trojan. Maybe even just generic adware. For all we know, it could have been a high-sophistication Stux-net grade trojan with a backdoor, but perhaps it partially malfunctioned. Without checking it myself, I can only surmise.

Frankly, based on what I see every day, I'd put my money that your grandfather initially fell for a phone call, malvertising, or at worst an adware campaign, that escalated into the scammers connecting in and connecting and installing a primitive trojan or adware serving specific messages that provided a bit more control over the messaging. It's equally possible, though, that it might be the same malvertisements or adware repeatedly displaying the same messages all along, and the scammers called him back because they know he'd already paid out before.

Answer 3

How were the scammers able to remotely trigger warning messages on his computer?

They had access before (through TeamViewer), so they can really do whatever the heck they want. They could install software that could let them remotely execute code, including the creation of popups (or anything else, really).

If they had access, why did they need my grandfather to enable TeamViewer?

There's lots of possibilities. One is that the software that they installed only had the capability to display popups when told to (as opposed to executing arbitrary code, which would be the more general and smarter thing to do). Thus, they'd want him to enable TeamViewer so that they can do more things.

But a simpler possibility is that it's just part of their script. They want to appear like they're legitimately helping you so that they can con you out of more money. They're not gonna reveal that they have put software on your computer. Easier to use the legitimate piece of software. Especially if TeamViewer makes it easier to follow their script (eg, a common usage is to open something like the Event Viewer, which is sure to have lots of scary looking "errors" -- they want you to be able to see those). And the script worked before, so why change it?

Are there any tests that I can run to check for malware?

There's many pieces of software that can detect malware of various types, but there's just no way to be 100% certain that there's nothing there (or that you found everything). Nuking everything is just the safest approach, given what you've described your grandfather seeing (as opposed to only nuking if your scanner detects something, as false negatives are common).