Malware in cruisecritic emails?

[h20skibum]

Has anyone experienced strange behavior lately with emails from cruise critic?  

 

I receive email notifications when something new is posted in threads I follow.  Those emails contain a button that will normally take you to the post.  On some occasions, instead of taking you to the post, it will open a window that says something like “You May be a $1,000 winner”

 

This has happened on a Safari browser both an iPhone and iPad, and you get a little indication that something is not right, when the button turns white  as you click it.

 

Just wondered if others experienced this.  Both devices are running the latest OS updates.  Doing a hard reset will eliminate the problem for a while, but it will return with new emails.

[Turtles06]

I was just coming on here to start a new thread when I saw yours.  On my end, the problem is manifesting itself not via emails but rather with phony ads popping up on my iPhone and iPad screens when I am on Cruise Critic. (Mostly  they seem to be phony Wal-Mart ads.)  This is the same problem we had a few years ago; back then it was phony ads telling you that you'd won an Amazon contest.

 

This started happening yesterday (Monday) and is still going on today, and it is ONLY happening when I am on Cruise Critic, not on any other sites.   Clearing cookies (which is a PITA, because it then wipes out my log ins for other sites) works, but only temporarily.    

 

I have done some research on this malware pop up issue and it seems possible that the problem is caused by the hacking of the legitimate ads on the web site in question (in this case, Cruise Critic).  In any event, it really needs to be dealt with.

 

I am flagging @CC Help Jenn so that she sees the issue.    Jenn, can you please look into this from your end?  Thanks!  

 

Folks: if you have this problem, do not click on those phony ads of course.  

Edited November 19, 2019 by Turtles06

[CC Help Jenn]

Thanks for tagging me!

 

I will look into -- if anyone has any screenshots please send on :)  Thank you

[broberts]

10 hours ago, Turtles06 said:

Clearing cookies (which is a PITA, because it then wipes out my log ins for other sites) works, but only temporarily.    

 

You should be able to clear cookies for just the CC sites.

[Turtles06]

16 minutes ago, broberts said:

 

You should be able to clear cookies for just the CC sites.

 

I’d already looked into this, and haven’t found any way to clear site-specific cookies in Safari on an iPhone or iPad (only on a Mac desktop).  If anyone knows whether it can be done and how to do it, I’d love to know and I’m sure others would as well. 

 

Edited to add: I just found this old article; it might work

https://appsliced.co/ask/how-do-i-delete-individual-cookies-from-my-iphone

Edited November 20, 2019 by Turtles06

[Charles4515]

11 hours ago, Turtles06 said:

 

I’d already looked into this, and haven’t found any way to clear site-specific cookies in Safari on an iPhone or iPad (only on a Mac desktop).  If anyone knows whether it can be done and how to do it, I’d love to know and I’m sure others would as well. 

 

Edited to add: I just found this old article; it might work

https://appsliced.co/ask/how-do-i-delete-individual-cookies-from-my-iphone

 

In settings select Safari.  At the very bottom is Advanced. Select Advanced. Website Data. Then Show all sites.

[Turtles06]

20 minutes ago, Charles4515 said:

 

In settings select Safari.  At the very bottom is Advanced. Select Advanced. Website Data. Then Show all sites.

 

Thanks. That’s what the link I posted says too. Happy to have that confirmation. 😊

[Turtles06]

On 11/20/2019 at 10:33 AM, Turtles06 said:

 

Thanks. That’s what the link I posted says too. Happy to have that confirmation. 😊

 

Unfortunately, as I’ve just discovered, once the scam ad pops up, just deleting the CC cookies alone is not enough.  😟

[Turtles06]

On 11/19/2019 at 1:20 PM, CC Help Jenn said:

Thanks for tagging me!

 

I will look into -- if anyone has any screenshots please send on 🙂 Thank you

 

 @CC Help Jenn any word on this?  After a break for a couple of days, the problem of phony ads popping up and taking over the entire screen when I’m on CC has returned today. And just deleting the CC cookies doesn’t help;  phony ad, once on the screen, can’t be deleted unless you delete all cookies. 

 

The phony ad today is one of those “Congratulations Amazon user!” scams that says to click OK for your free gift.  And, in the address bar for the ad, there’s what is no doubt a phony URL: amazon.com-gift-winner.vip

 

Thanks

[Charles4515]

2 hours ago, Turtles06 said:

 

 @CC Help Jenn any word on this?  After a break for a couple of days, the problem of phony ads popping up and taking over the entire screen when I’m on CC has returned today. And just deleting the CC cookies doesn’t help;  phony ad, once on the screen, can’t be deleted unless you delete all cookies. 

 

The phony ad today is one of those “Congratulations Amazon user!” scams that says to click OK for your free gift.  And, in the address bar for the ad, there’s what is no doubt a phony URL: amazon.com-gift-winner.vip

 

Thanks

 

I pretty much only use my iPhone and iPad and don't have any pop ups on CC. I don't have them on my Mac computer either. So my first question is in Safari settings do you have Block Pops toggled on? You should also have Prevent Cross Site tracking toggled on? If the answer to those is you do and still have pop ups  then I have a second question I will ask. 

[Turtles06]

21 minutes ago, Charles4515 said:

 

I pretty much only use my iPhone and iPad and don't have any pop ups on CC. I don't have them on my Mac computer either. So my first question is in Safari settings do you have Block Pops toggled on? You should also have Prevent Cross Site tracking toggled on? If the answer to those is you do and still have pop ups  then I have a second question I will ask. 

 

I do, on both devices.  

 

And to be clear, these aren’t legit pop ups, they are scams, malware, etc. and they take over the screen.    I don’t have genuine pop up ads popping up. 

 

 

[Charles4515]

6 minutes ago, Turtles06 said:

 

I do, on both devices.  

 

And to be clear, these aren’t legit pop ups, they are scams, malware, etc. and they take over the screen.    I don’t have genuine pop up ads popping up. 

 

 

Do you use a content blocker? 

[Turtles06]

8 minutes ago, Charles4515 said:

Do you use a content blocker? 

 

 No.  I’m not really familiar with them and I’d welcome your explanation, especially as to the possible relevance here. 

 

This is a specific issue that, from my research, seems possibly to be occurring because the fraudulent stuff is able to get thru at a moment in time via the legit ads on a specific site, in this case Cruise Critic.  That not everyone accessing CC on an iPhone or iPad is having the issue may only be a result of not being on CC at that moment in time. 

 

Thanks. 

 

[Charles4515]

2 hours ago, Turtles06 said:

 

 No.  I’m not really familiar with them and I’d welcome your explanation, especially as to the possible relevance here. 

 

This is a specific issue that, from my research, seems possibly to be occurring because the fraudulent stuff is able to get thru at a moment in time via the legit ads on a specific site, in this case Cruise Critic.  That not everyone accessing CC on an iPhone or iPad is having the issue may only be a result of not being on CC at that moment in time. 

 

Thanks. 

 

I definitely believe the issue is with CC. The malware are probably running scripts on the CC ads on their server. CC needs to root it out.  A content blocker blocks the ads. So it could  block the bad stuff but it would probably also block ads that are not bad. You might feel that you don’t want to block ads on CC because ads support the website. So that could be a dilemma and you might be willing to not do anything and wait for CC to fix the issue. Your choice. All they can do on an iPhone and iPad is be annoying. Cause they can’t install anything. On a computer they could install a browser hijacker. 

Edited November 23, 2019 by Charles4515

[h20skibum]

On 11/19/2019 at 1:20 PM, CC Help Jenn said:

Thanks for tagging me!

 

I will look into -- if anyone has any screenshots please send on 🙂 Thank you

Here is a screenshot of one that popped up today on cruise critic.

 

[Turtles06]

2 minutes ago, h20skibum said:

Here is a screenshot of one that popped up today on cruise critic.

 

Thanks for posting that.  The ones popping up today when I have opened CC on my iPhone and iPad are identical, except for where I live.

 

7 minutes ago, Charles4515 said:

I definitely believe the issue is with CC. The malware are probably running scripts on the CC ads on their server. CC needs to root it out.  

 

Charles, thanks for all your help and thoughts on this. 

 

@CC Help Jenn  I hope CC can get this stuff off its web site asap.   Thanks!

[h20skibum]

4 hours ago, Charles4515 said:

So my first question is in Safari settings do you have Block Pops toggled on? You should also have Prevent Cross Site tracking toggled on? 

 

Yes, and yes for mine also on both my iPhone and iPad.  No content or add blockers installed on either.

[Charles4515]

10 minutes ago, h20skibum said:

 

Yes, and yes for mine also on both my iPhone and iPad.  No content or add blockers installed on either.

 

Nothing is popping up on my iPhone or iPad. I do have a content blocker on both my iPhone and iPad. 

[Turtles06]

1 minute ago, Charles4515 said:

 

Nothing is popping up on my iPhone or iPad. I do have a content blocker on both my iPhone and iPad. 

 

Do you mind telling us which one, and what legit stuff it also blocks?  Does it create any problems in terms of your ability to see what you do want to see on the web sites you visit?    Thanks. 

[broberts]

7 hours ago, Turtles06 said:

 

Unfortunately, as I’ve just discovered, once the scam ad pops up, just deleting the CC cookies alone is not enough.  😟

 

You might try using a malware scanner. Not sure what is available on Apple platforms. On pc and Android, products like Malwarebytes and Super Antispyware can often remove unwanted cookies without disturbing others.

[Charles4515]

15 minutes ago, Turtles06 said:

 

Do you mind telling us which one, and what legit stuff it also blocks?  Does it create any problems in terms of your ability to see what you do want to see on the web sites you visit?    Thanks. 

I am using AdGuard. It won’t delete anything but ads unless you manually use the delete page elements feature. I have not had any problems to see what I want to on web sites but if you can easily turn off the content blocker. If you have iOS 13 installed at the top left where it says AA. You can turn off the content blocker and the page will reload without it. Also under AA is website settings so you can have the content blocker always on for a particular website or always off for a website. 

[itf]

Both myself and my wife are seeing fake "You've won Amazon vouchers" type adverts on here. It's clearly coming either from a compromise on CC or your advertising provider. This is not a problem on user devices.

[1025cruise]

It is more than likely the ad provider. I really with the ad providers had a better way to screen this crap out. 

[Charles4515]

On 11/23/2019 at 5:29 PM, broberts said:

 

You might try using a malware scanner. Not sure what is available on Apple platforms. On pc and Android, products like Malwarebytes and Super Antispyware can often remove unwanted cookies without disturbing others.

 

Apple devices on iOS like iPhones and iPads are generally not vulnerable to viruses or  malware.  iPhone and iPad apps can only be downloaded through the official Apple App Store.  The apps are all reviewed and scanned. Something malicious getting in the store is rare. As apps can only be installed form the store which prevents malicious software from infecting a device via fake apps. Apps for iOS are also “sandboxed”, meaning they can’t access data from other apps or break into the device’s OS. The sandboxing is much more restrictive than Android sandboxing. Also Apple updates all devices at the same time and the majority of users do update. The only way malware could make its way in is if the device is jailbroken.  So there are no malware scanners. Malwarebytes on iOS is an ad blocker..... not a malware scanner. I use Malwarebytes on my Mac computer because MacOS computers sandboxing is not as restrictive as iOS.  On a Mac computer you can install applications that don't come from the Apple App Store although every new version they have been making that more difficult.  Of course iPhone  and iPad users can still be phished and users should use a VPN to protect data going out over the internet at public WiFi hotspots.

Edited November 24, 2019 by Charles4515

[Turtles06]

@CC Help Jenn  I hope you had a good weekend.  I'm flagging that Monday morning has started out the same way on CC on my iPad with another bogus "Congratulations Amazon User" piece of malware taking over the screen, the same one shown in the screenshot by @h20skibum in comment 15 above.    Thanks.