Some users of the ad-supported music streaming service Spotify Free got more hits than they bargained for, according to numerous reports.
It all started on Tuesday (4th), when one of its users reported an issue to their forum. It read:
There's something pretty alarming going on right now with Spotify Free. This started several hours ago. If you have Spotify Free open, it will launch - and keep on launching - the default Internet browser on the computer to different kinds of malware / virus sites. Some of them do not even require user action to be able to cause harm.
I have 3 different systems (computers) which are all clean and they are all doing this, all via Spotify - I am thinking it's the Ads in Spotify Free.
Within a matter of hours, Twitter users were echoing these sentiments and indicating that browsers on Windows 10, MacOS and Ubuntu were launching and spawning the suspect ads.
AppleInsider reported that the questionable sites were distributing potentially infectious Javascript and Flash executables.
Subsequently, Engadget and TrustedReviews made inquiries to Spotify, which issued the following statement:
A small number of users have experienced a problem with questionable website pop-ups in their default browsers as a result of an isolated issue with an ad on our free tier. We have now identified the source of the problem and have shut it down. We will continue to monitor the situation.
Spotify was hit with a similar incident in 2011, when an ad that appeared directly in their Windows desktop software installed a bogus antivirus program.
At the time, Spotify noted that users running antivirus software were protected.
Spotify’s response indicated that one ad was responsible for spawning and re-spawning multiple malicious ads.
Commenting on the story, ESET's Lysa Myers said: "Users need to be aware that free apps come with a cost – of extra risk due to malvertising. It might behoove people to take their business to vendors with a good track record of not using ad networks that infect users. But keep in mind that sometimes these things slip into otherwise high-quality ad networks, so it’s a good idea to keep your software – especially OS, browsers and plug-ins – regularly updated, and have anti-malware suite including a firewall on your machines. Linux and OS X are not immune, and need to be protected with security software as well."
In 2014, Spotify experienced a data breach. While it was a highly isolated incident – only one user's data was accessed – the music giant nevertheless took the incident seriously.
It stated at the time: "We take these matters very seriously and as a general precaution will be asking certain Spotify users to re-enter their username and password to log in over the coming days.
"As an extra safety step, we are going to guide Android app users to upgrade over the next few days."
