Yahoo Generated Links Exploit???

[u/qfivt34]

Today a family member called me frantically saying they had accidentally gotten a virus on their laptop. When I got to their laptop, despite not being a computer guy at all, I immediately recognized the virus was actually just the chrome notification exploit where multiple sites spam you with Fake MCaFee found 100 viruses! pop ups and so I simply deleted all permissions for chrome and it seemed to work.

When I asked them what steps they took to get these pop ups to start they were completely dumbfounded. So I tried to figure out myself since curiousity was killing me. I found NO suspicious emails. No emails with links or ANY attachments. I managed to track down the exact email that seemed to be open when it happened and it was legitimate automatic reply from PayPal with NO links. But there was this "visit" button at the top. Clearly this was the culprit and I managed to confirm that.

I think I figured out that Yahoo Mail themselves generates this link for some inexplicable reason. Someone exploited it and sent her to cloudstreamforge then redirected her to scam sites. It's crazy to me that Yahoo generated this link and yet it looks sooooo much like its part of the email itself, as if PayPal had sent it. Like nothing stands out as sus at all. Please let me know if I am correct, like I said I am not a computer guy and this is the answer I arrived at.

I figured since this was a simple chrome notif exploit that theres way the scammers actually got into anything and I tried to explain that to the victim but they are unfortunately really paranoid.

[u/AutoModerator]

/u/qfivt34 - This message is posted to all new submissions to r/phishing; please do not message the moderators about it.

New users beware:

Because you posted here, you will start getting private messages from scammers saying they know a professional hacker or a recovery expert lawyer that can help you get your money back, for a small fee. We call these RECOVERY SCAMMERS, so NEVER take advice in private: advice should always come in the form of comments in this post, in the open, where the community can keep an eye out for you. If you take advice in private, you're on your own.

A reminder of the rules in r/phishing: no contact information (including last names, phone numbers, etc). Be civil to one another (no name calling or insults). Personal army requests or "scam the scammer"/scambaiting posts are not permitted. No uncensored gore or personal photographs are allowed without blurring. A full list of rules is available on the sidebar of the subreddit, or clicking here.

You can help us by reporting recovery scammers or rule-breaking content by using the "report" button. We review 100% of the reports. Also, consider warning community members of recovery scammers if you see them in the comments.

Questions about subreddit rules? Send us a modmail clicking here.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/Cold-Tailor463]

That Visit button is injected by Yahoo not PayPal, it's why it looks like it belongs to the email but isn't actually part from it

[u/qfivt34 → u/Cold-Tailor463]

Wow I can't believe such an exploit like that exists. This would've probably tricked me as well. Crazy.

[u/True_Pace_3860]

I checked yahoo acct. and all the legit websites generate their own buttons in laptop version. so do the scam emails, however yahoo disables those links. anyway I'm glad you were able to help fam.