Tony Blair has NOT died today
Summary: A webpage hosted on an IP address tied by whois lookup to the Armenian branch of Nathan Associates Inc falsely claimed former UK Prime Minister Tony Blair had died, using the same template as the BBC News website. Loading the page prompted users to install a fake "Adobe Flash" update that downloaded a file ClamAV detects as Trojan.Agent-21076, which changed Internet Explorer's start page to adultmeeter.com and edited the Windows hosts file to redirect abbey.com and cajamadrid.es to phishing sites.
What you should know: The hosts-file edit silently rerouted users typing their bank's address to phishing pages, so the compromise outlasted the fake news story and defeated the habit of checking the URL bar.
Read the original at Cisco Talos ↗
- Topics
- Governance, Risk & Compliance
- Related
- Upcoming Speaking Engagements Cyber Risks · Nov 14, 2026Friday Squid Blogging: Pacific Flying Squid Populations Dropping in Korean Waters Cyber Risks · Nov 13, 2026AI Doesn’t Have to Go Rogue to Break the World Cyber Risks · Nov 13, 2026