Chrono Pay Fueling Mac Scareware Scams
Summary: Mac scareware scams that began on May 2, 2011, spreading through poisoned Google Image Search results, directed users to pay for worthless security software via domains including mac-defence.com and macbookprotection.com. The WHOIS records for both domains carried the contact address fc@mail-eye.com, tied through leaked ChronoPay documents to the Russian payment processor's financial controller, Alexandra Volkova, and the same account was later used to register appledefence.com and appleprodefence.com.
Key Takeaway: ChronoPay was the core processor for the rogue anti-virus affiliate program behind the first strain of Conficker in 2008, and it denied involvement in the MacDefender attacks; the registrar Webpoint.name suspended the two Mac domains, but the same account registered two more that had not yet appeared in attacks.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026