How to stop the HoeflerText attack with MB3

[mynorgeek]

I have encountered this social engineering attack on the web.  

The first time I saw it, I thought it might be legit, and I started to download (into a Sandboxie-protected folder), but didn't even complete the download, let alone recover the file and execute it.  

I am now well aware of the attack, but would still like to know how to configure MB3 to block these HoeflerText popups, or, for someone to explain to me why MB3 is not already blocking them?

[Telos]

It sounds as through you are infected w/adware. You should use MB's AdwCleaner to remove adware from the computer. If that doesn't resolve your issue, you should open a malware support thread here:

https://forums.malwarebytes.com/forum/108-malware-removal-help/

[mynorgeek]

5 minutes ago, Telos said:

It sounds as through you are infected w/adware. You should use MB's AdwCleaner to remove adware from the computer. If that doesn't resolve your issue, you should open a malware support thread here:

https://forums.malwarebytes.com/forum/108-malware-removal-help/

Actually, I am not infected.  The site I visited is infected, and is using a soc eng method of trying to infect me.  I have seen this pop up only on one site.  Read about the HoeflerText attack.  I want to know how to stop the popups if/when they are encountered on the web.  TY

[shadowwar]

Please report the site here:

 

https://forums.malwarebytes.com/forum/155-newest-ip-or-url-threats/

[mynorgeek]

I have discovered that the HoeflerText popup only happens when connected via my VPN.  I have contacted their support for further assistance.

Note to Telos, thank you for your AdwCleaner suggestion.  I did run it and there are no infections.

Chrome: The “HoeflerText” font wasn’t found scam
 

Quote

 

The "HoeflerText" font wasn't found is a recent attack that changes website text so that it looks as if a font is missing, to get users to download and install an alleged update for Chrome that adds the font to the system.

The attack requires that the user visits a compromised website.