Click Your Poison
Season 1
Number 10
Writer Denise Hahn
Director Dermott Downs
Original Airdate May 6, 2015
Previous Episode: L0m1s
Next Episode: Ghost in the Machine

Click Your Poison is the tenth episode in Season One of CSI: Cyber.


The cyber team investigates when a man dies after taking medication he purchased from a hacked ad on a medical website.


Malvertisement - an infected online ad that redirects an unsuspecting user to a malicious site.

In Cleveland, Ohio, 36-year-old Carl Bruno suddenly becomes disoriented and begins sweating profusely. He wanders into the middle of a busy street, where he's struck by a car and killed; a prescription pill bottle is found near the body.

Autopsy results confirm that Carl's cause of death was blunt force trauma caused by the impact with the car. The death has piqued the interest of the FDA because the prescription bottle came from an online Canadian pharmacy called JPBPharmacy.com. Other patients had reported the website to the FDA based on the bad reactions they had to the drugs they purchased; however, nobody had died until now.

The Cyber Division has been looped in because the belief is that the patients were guided to JPBPharmacy.com by fraudulent ads on a medical website called ScrollMD. Over 800,000 people per day visit the site seeking second opinions or searching for general health conditions. Ads on the site are redirecting users to what could be a fictitious pharmacy. Carl had ordered Tramizor, a drug to treat his heart disease; however, his autopsy results show that the drug was ineffective because it had no pharmacological ingredient. He was, in fact, purchasing a placebo. Furthermore, tox results showed the presence of a fungus along with doses of oxycodone, a pain reliever and mood enhancer. The victims were under the impression they were getting better when they actually weren't. Avery concludes that Carl's death wasn't an accident, it was a homicide.

Krumitz discovers that someone hacked an ad on the ScrollMD site and injected an HTML code behind it—a click-baiting scheme. If the user toggles between the ads, the fake ad masks the legitimate one. The target had to have breached the ScrollMD servers to inject the code, something the company was unaware of. Krumitz also finds that no matter what symptoms a user typed into the search field on the site, they were informed they had a serious ailment, such as heart disease or cancer. In other words, the site's algorithm takes any symptom and links it up with a bunch of others, taking advantage of the hypochondriacs who may visit the site.

JPBPharmacy.com is not only selling counterfeit heart medication, it's fraudulently selling nine other drugs used to fight things like high blood pressure, diabetes, and cancer. The drugs the target has chosen to distribute are the most expensive and sought after in their categories. Avery tells Simon that the target is operating on the Surface Web, where he can reach millions of everyday citizens. Her fear is that the target knows how to operate in the open without getting caught, potentially making him more elusive and dangerous than someone operating in the Deep Web.

Carl's widow stops by headquarters and admits that she's the responsible for his death. She had bought the counterfeit heart medication from JPBPharmacy.com in order to save money, believing that the ad was legitimate because it was on ScrollMD. Attempts to contact the company were largely unsuccessful, but she printed receipts and e-mails to help with the investigation. She also had a package of heart medication delivered to her the day before, something she also provides. There's no return address on the package; however, there's a return zip code stamped on it corresponding to San Antonio, Texas. Krumitz and Nelson are provided with 562 IP addresses on a map and, by process of elimination, are able to narrow down which machine stamped the package.

In San Antonio, Avery and Elijah lead a SWAT team to the house of Paul Cummings, whose IP address links him with shipping out the counterfeit drugs. When Paul reveals himself, it's clear that he has a serious illness. Avery correctly guesses that he's involved with a prescription drug ring; however, he's just the middleman working for someone else. She also figures out that Paul took the job in order to gain access to the same drugs he's distributing. The drug he needed access to is Lindrexia, which is supposed to treat cancer; however, like Carl, the drug is having no effect and is actually making him sicker.

Paul tells Avery and Elijah that he met a guy in a cancer support chat group online. This person supposedly had access to black market Lindrexia and would let Paul have some of it if he agreed to distribute the other drugs. He never met the guy in person, as each exchange was a dead drop. When his lung cancer came back for a third time, doctors refused to prescribe Lindrexia to Paul, so he had to resort to other methods. He becomes distraught when told that his "shipping business" resulted in someone else's death. Soon thereafter, he excuses himself and goes to the bathroom, where he slits his wrist with a straight razor. Avery is able to stop the bleeding, save Paul's life, and have him transported to the hospital.

Avery and Elijah conclude that Paul was hired because he was hopeful and wasn't in it for the money. Their target is a sociopath who lacks empathy and remorse, taking advantage of people who can be easily manipulated and controlled. Remembering that Paul had mentioned a dead drop, Avery has Elijah take a deeper look into Paul's phone. Once a week, Paul would leave his house, make one stop at 9:00 AM, and drive directly back. This spot is assumed to be the dead drop location. If Paul was picking up drugs, someone had to be dropping them off, and Avery sets out to access the traffic cameras in the area.

Simon visits with personal friend and ScrollMD CEO Marcus Billings, who is in disbelief that his website was maliciously targeted. He takes it under advisement when told that the infected ads should be removed and the servers scrubbed for any other malicious code. However, he refuses to issue a public warning on the site's homepage, fearing that it will open him up to lawsuits and a loss of sponsors.

Avery and Elijah head to the drop zone and identify the security camera that caught the exchange. Unfortunately, the car that made the original drop was using an IR LED array, making their license plate unreadable to cameras. The driver was also too far away from the camera to get a clear shot of his face. Elijah realizes that their target was driving a newer model SUV, which means it was probably equipped with Bluetooth. The Department of Transportation keeps a record of each Bluetooth signal that pairs with a monitoring system; this allows them to report traffic patterns. This gives the team a digital fingerprint that can be matched to the SUV's VIN number, which should allow them to get the driver's ID and registration from the DMV.

The driver of the SUV is identified as Randall Fung, who is found in his barn with a few other associates. Dozens of different brands of pills are laid out over workstations; it's clear that this is the base of operations. After being detained, Randall continues to gaze at the pills, not the laptops set up. From this, Avery deduces that Randall is the pill cook, but isn't a cyber criminal. He's arrested on fraud, conspiracy, and trafficking counterfeit goods, but is offered a deal if he reveals who the other head of the operation is.

Jane Bruno addresses the media about her husband's death and ScrollMD's refusal to take responsibility for it. Marcus Billings soon angrily confronts Simon and informs him that his entire website is down. He blames Simon and his team for this, as well as Jane's media attack against the company. Simon replies that he wants the same thing Jane does—for ScrollMD to be held accountable. He also warns that things will only get worse in the next few weeks, as millions of people visit the website every month. Whether those people get killed or get cured may fall on Marcus' shoulders.

Krumitz and Nelson go through the computers recovered from the barn, discovering that both Paul and Randall had bookmarked the same poker site. Their user history shows that for two months, they both logged in every Saturday and played a single one-on-one game against an opponent, which they would win. The quick conclusion is that the two weren't playing poker, they were getting paid for their services.

Due to a nationwide shortage, the target escalates to distributing counterfeit flu medication, thereby expanding his business. Avery builds a psychological profile of the target, believing him to be a professional between the ages of 20 and 45 who's perfected the art of blending in. He's likely to be average looking and have poor social skills, choosing to live his life behind a computer screen. Because of this, his choice would be to blend in when he left his house, likely wearing glasses with thick frames to draw attention away from himself. Avery tells Simon that they have to give their target a reason to pop out into the real world. She asks for $250,000 in order to trap the target.

The money is used to buy $250,000 worth of drugs from JPBPharmacy.com, which they know the target will launder through the poker site. He logs into the site and launders the money from one fake user to another; however, things get more complicated when he spaces it out over 16 tables, making the movements harder to track. The money soon gets funneled towards one user; however, Krumitz discovers that there's a separation of privileges on the server. A whole other layer of encryption separates administrator access ("yellow zone") from where the bank accounts are stored ("red zone"). By the time Krumitz is able to get authenticated and get full access, the target gets his $250,000 and leaves the site.

Nelson realizes that there still may be a trace of the target in the system. Because his winnings in yellow zone still have to communicate with his bank account in the red zone, the plan is to plant a bug in that line of communication. Krumitz injects the firewall with a virus that identifies the bank in Kentucky where the money is being stored. The following morning, Shawn Morris (who fits Avery's earlier description) tries to withdraw the money, but realizes something is up when he gets eyeballed by the bank employees. Upon leaving the bank, he's tackled to the ground by Avery and placed under arrest.

The team celebrates a job well done, as they saved lives and got over a hundred contaminated drugs off the streets. They're soon alerted to a press conference being held by Marcus Billings. In it, he announces that ScrollMD will be the first website of its kind to issue a public warning on its homepage alerting users to the dangers of fraudulent online advertising. Furthermore, the company will also lead an initiative in Congress to ensure that all health websites maintain a higher level of security.


Main Cast[]

Guest Cast[]

  • Michael Irby as Navy Cap. David Ortega M.D.
  • Tehmina Sunny as Tanya Schaffer
  • Dahlia Salem as Jane Bruno
  • Kevin Oestenstad as Paul Cummings
  • Brian McNamara as Marcus Billings
  • Kamal Jones as Man
  • Rod Keller as Shawn Morris
  • Alex Marino as Carl Bruno
  • Haley Sims as Bank Teller
  • Yutaka Takeuchi as Randall Fung
  • Christine Weatherup as Dr. Abbot
  • Andrew Dinh as CTOC Tech
  • Alysson Da Silva as Civilian
  • John Darren as Detective


  • Hayley Kiyoko (Raven) is credited but does not appear in the episode.


See Also[]

CSI:Cyber Season 1
Kidnapping 2.0CMND:\CrashKiller En RouteFire CodeCrowd SourcedThe Evil TwinURL, InterruptedSelfie 2.0L0m1sClick Your PoisonGhost in the MachineBit by BitFamily Secrets