$14M Click Hijacking Scheme — Feds Bust

Group hijacked computers to earn advertising revenue.

Call it click fraud on steroids.

The U.S. government has busted six Estonian nationals and one Russian national for what they call a massive click hijacking ring.

The group allegedly used “rogue” Domain Name System servers and malware to alter the DNS server settings on infected computers. They infected over four million computers counting 500,000 in the United States.

By controlling the DNS the criminals were able to control computer users web usage. This meant they could divert users to different sites (some under affiliate programs) or display their own ads on top of legitimate sites.

For example, when someone clicked on a link for the actual IRS site they were instead re-routed to tax preparer H&R Block, presumably through some sort of affiliate link. When someone visited ESPN.com, an ad for “Dr. Pepper Ten” was replaced with an ad for a timeshare business.

In total the government states the defendants earns $14 million from the”click hijacking” and “advertisement replacement fraud”.