Key Facts:
On 3 separate occasions, in the past 3 months, with 3 different google search queries, I was redirected from the intended site to a malicious site. Always from a Google search using Firefox.
The redirect is not repeatable: doing the search again and clicking on the same link does not redirect. This is on work computer, signed into a domain, on Windows 10.
I ran a Malware Bytes Scan. All negative. No proxies, and the hosts file has no unknown entries.
Firefox Extensions
- ADB Helper
- Firefox Pioneer
- LastPass
Firefox Plugins
- Openh264 Codec
- Widevine Content Decryption
- Shockwave Flash (out of date, but also set to "Ask to activate")
More Details
As best I can tell from looking at my Firefox history, the redirects happened in about September 15, then again on Oct 30, and again today (Nov 8). Each redirect was through completely unrelated websites and unrelated searches. (I am excluding the searches and websites I clicked on, but will include them if requested). As far as I was able to tell, the sites were running different platforms, and a quick eyeball of the source didn't reveal any malicious code on these sites. Each redirect was to a similar site.
This is on a work computer, but we're a medium-small business without a truly dedicated IT team (I kind of serve as backup IT when the main guy is out). We haven't heard of any reports from other employees of problems, but in the way I experienced it, its very easy to dismiss. Because if you get redirected, its easy to assume you accidentally clicked the wrong link or the site you visited was hacked. And if you try to repeat your steps, you get to the site you were intending, so you assume you did something wrong. In any case, the primary IT guy here hasn't encountered the problem, so we believe its my local machine but I don't know where to look now.