---
title: Fake Symantec Blog Is Spreading Malware
description: A fake symantec blog is spreading malware.
---

[SecureWorld News ](https://www.secureworld.io/industry-news)

# [Fake Symantec Blog Is Spreading Malware](https://www.secureworld.io/industry-news/fake-symantec-blog-is-spreading-malware)

 Written by [SecureWorld News Team](https://www.secureworld.io/industry-news/author/secureworld-news-team) | Mon | Nov 27, 2017 | 4:59 PM Z

Sunday night, a series of tweets from security researcher  [@noarfromspace](https://twitter.com/noarfromspace) revealed a new variant of the OSX.Proton malware, spreading in a concerning new method—spoofing security company Symantec’s blog.

Apparently, it's a near mirror image of Symantec's actual blog, with matching pop-ups that can fool users into activating the malware on their machines.

Symantec's real blog URL: [https://www.symantec.com/blogs/](https://www.symantec.com/blogs/)

Fake blog URL: symantecblog[dot]com

Malwarebytes has [a nice blog post](https://blog.malwarebytes.com/threat-analysis/mac-threat-analysis/2017/11/osx-proton-spreading-through-fake-symantec-blog/) on this right now and how the site functioned.

When SecureWorld checked the fake site, the ISP had taken the site offline:

[View full post](https://www.secureworld.io/industry-news/fake-symantec-blog-is-spreading-malware)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "SecureWorld News Team"
  },
  "dateModified" : "2017-11-27T17:48:35.006Z",
  "datePublished" : "2017-11-27T16:59:43Z",
  "headline" : "Fake Symantec Blog Is Spreading Malware",
  "image" : {
    "@type" : "ImageObject",
    "height" : 288,
    "url" : "https://cdn2.hubspot.net/hubfs/2221756/symantec-security-flaw.jpg",
    "width" : 510
  },
  "mainEntityOfPage" : "https://www.secureworld.io/industry-news/fake-symantec-blog-is-spreading-malware",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60.0,
      "url" : "https://cdn2.hubspot.net/hubfs/2221756/Logos/SWE/SWE_logo_full-long_forWHITEbackgrounds.jpg",
      "width" : 304.46954
    },
    "name" : "SecureWorld News"
  }
}
```