'Urgent Firefox Update' Pop-Ups

The 'Urgent Firefox Update' pop-ups are attacks that install threatening or unwanted programs on your PC while pretending to update your Web browser. Although the 'Urgent Firefox Update' pop-ups may imitate the superficial appearance of update prompts, they are unaffiliated with Mozilla, who never will use pop-up windows for Firefox's maintenance. Malware experts recommend active anti-malware tools for blocking the 'Urgent Firefox Update' pop-ups or removing the aftereffects of these attacks.

When You're Better Off with an 'Outdated' Web Browser

The 'Urgent Firefox Update' pop-ups are a mid-July campaign of exploits, making use of zero-day vulnerabilities in Flash, JavaScript, or other, common Web elements potentially. These attacks have been circulating throughout a wide range of diverse websites, including the non-threatening Breitbart.com news domain. Such broad infection vectors have led malware analysts to suspect that the campaign's operator has compromised one or more advertising networks. Nowadays, there are no cases of associating the 'Urgent Firefox Update' pop-ups with the previous installation of browser-hijacking plugins or extensions.

Unlike official Firefox updates, the 'Urgent Firefox Update' pop-ups launch a new browser window that requests that the PC user installs an 'urgent' security update. Besides varying the URLs used for triggering them, the 'Urgent Firefox Update' pop-ups also have shown multiple formats of attacks, some of which require the PC user's consent to initiate the download, and others of which use unspecified software vulnerabilities for starting their downloads automatically.

Also, unlike actual Firefox patches, malware experts saw no correlation between out-of-date Firefox versions and the presence of the 'Urgent Firefox Update' pop-ups. The payloads carried by these threats are still under analysis. In the recent past, such attacks have most often installed high-level threats of a variety of types, including advanced spyware, banking Trojans, and other threats dedicated to exfiltrating information.

Dousing the Urgency of the Newest and Worst of Firefox Updates

Both thematically and technically, the 'Urgent Firefox Update' pop-ups are, as a campaign, not significantly different from past attacks using the disguises of fake patches to attack Web traffic. However, the campaign's widespread distribution over an unpredictable surface area makes it more likely than not that a computer user will encounter the 'Urgent Firefox Update' pop-ups without having done anything unsafe intentionally, such as traveling to a corrupted website or clicking a spam link.

In cases of compromised legitimate websites, having default browser security features are an essential facet of defending your PC. Blocking scripts or advertisements, when appropriate, updating all related software through authorized channels, and having anti-malware products with an active website monitoring feature are some of the most commonly-used protections. In most cases, malware experts found updated anti-malware software blocking the 'Urgent Firefox Update' pop-ups before their downloads could complete and install unwanted software automatically.

Even though patching your browser is a core part of keeping it safe from Web attacks like the 'Urgent Firefox Update' pop-ups, using illegitimate sources to update your browser is often no better than downloading Trojans intentionally. Firefox users can verify their version of the Web browser by selecting the 'About Firefox' option from the menu bar. Of course, like most fake updates, the 'Urgent Firefox Update' pop-ups also are identifiable by using a browser pop-up, instead of an internal UI, for loading their downloads.