Thread by @saill

A few days ago, @kottipillar, @researchagain, and many others began noticing promoted Russian-language ads showing up in their Twitter feeds.

https://twitter.com/KottiPillar/status/1106775235817144321

Clicking on this promoted link brings up a tweet promoting a Russian taxi service.

The link appears to go to the website city-mobil(.)ru.

But notice what you see at the bottom of your browser window when you mouse over the link.

Instead of going directly to the City Mobil website, the link redirects you to an odd web address at trk(.)mail(.)ru.

Wait. Don't click that...

Very carefully - using a VPN and without involving a browser, we can see where that link takes us.

It looks like we are redirected to the city-mobil(.)ru site via a server belonging to mail(.)ru.

Not only that, but when we look at the code for the page we arrive at, we can see that it downloads a javascript file from yet another mail(.)ru url.

The link to this javascript file includes a random number in the url which prevents the file from being downloaded and analyzed.

Using the great resource Virus Total, we can examine the mail(.)ru domain that's hosting that javascript file. Notice the "communicating files". Those are Windows virus files that "call home" to this domain.

That's not so good. Trust me on this.

virustotal.com/#/domain/1l-go…

Here some of the virus detection services that flag this as malware. Looks like there is a known mail(.)ru virus.

Let's find out more about these mail(.)ru viruses. "...data tracking can lead to serious privacy issues or even identity theft" - pcrisk.com/removal-guides…

Moral(s) of this story?

1) Always mouse over a link and check the notification that shows up near the bottom left of your browser window before clicking.
2) Don't click unless the domain you see matches the one shown in the link.

3) Don't click unless the domain is known and trusted.
4) Follow these rules even if you do happen to be in Moscow and need a taxi.