Jump to content

Opera.com hacked - distributed malware to probably thousand of users

opera hack malware

  • This topic is locked This topic is locked
2 replies to this topic

zmeul #1 Posted 27 June 2013 - 04:42 PM


  • Beta Tester
  • 19552 battles
  • 2,133
  • Member since:
I don't usually report about this stuff, but this is rather serious issue. Haven't been using Opera browser for many months now, but I know that a lot of other people do.

According to a post on the Opera Security Blog, the company suffered on June 19th “a targeted attack on  internal network infrastructure”. The attackers were able to obtain at least one old and expired Opera code signing certificate, which they have used to sign some malware. This has allowed them to distribute malicious software which incorrectly appears to have been published by Opera Software, or appears to be the Opera browser.

What Opera is describing here is the nightmare of any company having millions of users:
  • internal network breached
  • signing certificates stolen
  • certificates used to sign malware
Can it go worse? Yes, it can.
  • the website distributed automatically company signed malware to their users:


It is possible that a few thousand Windows users, who were using Opera between 01.00 and 01.36 UTC on June 19th, may automatically have received and installed the malicious software.

If you are / or were using Opera:
  • uninstall Opera
  • install a serious antivirus software
  • do a complete system scan
  • if you see a detection of TR/Ransom.GR.1 or any of the malware names below (*), then you’ve been affected, let the scanner remove all the files found.

  • a screen locking ransomware impersonating the local authorities (detected as TR/Ransom.GQ.1)
  • an information stealing trojan (detected as TR/Kazy.adag)
  • a backdoor which allows that communicates with several remote servers and may allow 3rd party control of the infected system. (detected as BDS/ZAccess.BS)

BattleMetalChris #2 Posted 27 June 2013 - 04:47 PM

    Lieutenant General

  • Player
  • 9224 battles
  • 7,685
  • Member since:
Crikey.  That's kind of crazy.

Wolfesblut #3 Posted 27 June 2013 - 08:04 PM

    Lieutenant Сolonel

  • Player
  • 17252 battles
  • 3,224
  • Member since:
Thanks for the info.

Also tagged with opera, hack, malware

1 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users