Friday, November 1, 2024
HomeAppleOperation Poisoned News - Hackers Deliver Malware Targeting iOS Users Using Local...

Operation Poisoned News – Hackers Deliver Malware Targeting iOS Users Using Local News Links

Published on

Malware protection

A new campaign dubbed Operation Poisoned News that uses news local news sites links to deploy malware called lightSpy on the user’s iOS devices.

Attackers posted the news articles in various forums, by clicking on the link it takes users to the news sites, but they also have hidden iframe that loads malicious code.

The malicious code is capable of exploiting vulnerabilities present in iOS 12.1 and 12.2, clicking on those links leads to the installation of malware lightSpy on the iOS devices.

- Advertisement - SIEM as a Service

Poisoned News Campaign

The lightSpy is the backdoor module that allows attackers to execute the code remotely and to manipulate files in the affected device.

Security researchers from Trend Micro observed the watering hole attack targeting iOS users. The links posted by the attackers include three iframes.

The only visible link is the original news website, with the other two invisible links, one used for analytics purposes and another site hosting exploits.

Here you can find the three iframe

Operation Poisoned News
iframes

The attack particularly targets Hong Kong residents, attackers posted links on various popular forums to infect more victims.

To trick the user’s attackers posted the links under the topics such as sex-related, clickbait-type headlines, or news related to the COVID-19 disease.

Researchers also observed another attack type in which the attackers copied the legitimate site and injected with a malicious iframe.

Operation Poisoned News
Second method

The malware modules for exfiltrating data infecting device, that includes;

  • Connected WiFi history
  • Contacts
  • GPS location
  • Hardware information
  • iOS keychain
  • Phone call history
  • Safari and Chrome browser history
  • SMS messages
  • Available WiFi network
  • Local network IP addresses
  • Telegram
  • QQ
  • WeChat

Exploiting iOS 12.1 and 12.2

The exploit used in the attack affects iOS 12.1 and 12.2, it attacks a variety of iphone models from the iPhone 6S up to the iPhone X.

Operation Poisoned News
Versions

“The full exploit chain involves a silently patched Safari bug (which works on multiple recent iOS versions) and a customized kernel exploit,” researchers told.

Once the attacker gained access to the device they install sophisticated spyware to maintain control over the device. The spyware modules designed specifically to exfiltrate the data.

Here are the complete attack chain and modules used

Attack Chain

Researchers also noted an Android counterpart to lightSpy which is called as dmsSpy, the variant was distributed in Telegram channels as apps in 2019.

The dmsSpy malware also includes various functions like traditional malware. It steals more sensitive information such as contacts, text messages, the user’s location, and the names of stored files.

Researchers have notified the vulnerabilities to Apple via Trend Micro’s Zero Day Initiative (ZDI) and to Telegram also, but no response received.

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS...

ATPC Cyber Forum to Focus on Next Generation Cybersecurity and Artificial Intelligence Issues

White House National Cyber Director, CEOs, Key Financial Services Companies, Congressional and Executive Branch...

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan...

Konni APT Hackers Attacking Organizations with New Spear-Phishing Tactics

The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS...

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan...

Konni APT Hackers Attacking Organizations with New Spear-Phishing Tactics

The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on...