---
title: VeryMal Strikes Again With a New Twist on Its Complex Redirect Attack
description: At least a million machines exposed
---

[News - Confiant ](https://www.confiant.com/news)

# [VeryMal Strikes Again With a New Twist on Its Complex Redirect Attack](https://www.confiant.com/news/verymal-strikes-again-with-a-new-twist-on-its-complex-redirect-attack)

 Written by [AdMonsters](https://www.confiant.com/news/author/admonsters) | Mar 21, 2019 4:00:00 AM

Sometimes… Oftentimes… They come back.

The [redirect attacks](https://www.admonsters.com/tag/mobile-redirects/), that is, something just about every publisher at [AdMonsters’ Publisher Forum in Miami](http://admonsters.com/miami) last week could attest to. And every one of those attendees has definitely thought to themselves, “Who the hell is doing this?”

Enter VeryMal, a relatively new malvertising group that’s been causing [a great deal of havoc in 2019](https://www.zdnet.com/article/malvertising-campaign-targets-apple-users-with-malicious-code-hidden-in-images/). On March 13, [Confiant’s](http://confiant.com/) real-time malvertising scanner picked up a spike in redirects tied to [Google’s Firebase](https://firebase.google.com/), an evolution from VeryMal’s previous use of [steganography](https://securityintelligence.com/steganography-a-safe-haven-for-malware/).

However, the package delivered gave the culprit away: a forced redirect to a fake Flash installer that actually implants a [Shlayer Trojan](https://www.intego.com/mac-security-blog/osxshlayer-new-mac-malware-comes-out-of-its-shell/) on a user’s device. Lasting around 36 to 48 hours, this attacked affected around 1 million users, with a taste for those on desktop Safari.

To learn more about the ne’er-do-wells behind the nuisance, we asked Confiant Senior Engineer Eliya Stein and CEO LD Mangin for more details on this latest attack and what makes VeryMal such a sophisticated attacker. We also got a peek into Confiant’s latest [Demand Quality](https://www.confiant.com/quality-report) report (which we’ve [written about](https://www.admonsters.com/spread-bad-ads-pretty-terrible-confiant-reports/) [before](https://www.admonsters.com/bad-ads-dip-q3-bad-actors-forewarned)) and their mysterious new “Chief Quality Officer.”

**Read Complete Article:** [https://www.admonsters.com/verymal-strikes-new-twist-complex-redirect-attack/](https://www.admonsters.com/verymal-strikes-new-twist-complex-redirect-attack/)

[View full post](https://www.confiant.com/news/verymal-strikes-again-with-a-new-twist-on-its-complex-redirect-attack)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "AdMonsters"
  },
  "dateModified" : "2023-01-11T04:32:55.689Z",
  "datePublished" : "2019-03-21T04:00:00Z",
  "headline" : "VeryMal Strikes Again With a New Twist on Its Complex Redirect Attack",
  "image" : {
    "@type" : "ImageObject",
    "height" : 296,
    "url" : "https://f.hubspotusercontent20.net/hubfs/5994026/Imported_Blog_Media/news%20blog%2062-1.png",
    "width" : 296
  },
  "mainEntityOfPage" : "https://www.confiant.com/news/verymal-strikes-again-with-a-new-twist-on-its-complex-redirect-attack",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "News"
  }
}
```