Monday, May 5, 2025
HomeAppleeGobbler Malvertising Campaign let Hackers Hijack 500 Millions of iOS Users Sessions...

eGobbler Malvertising Campaign let Hackers Hijack 500 Millions of iOS Users Sessions Using Chrome Bug

Published on

SIEM as a Service

Follow Us on Google News

Researchers discovered a recent malvertising campaign from eGobbler  threat actor that targets millions of iOS users to hijack their sessions by leverage chrome vulnerability.

Attackers trick the targeted iOS users to redirect into Malicious lading page and this campaign can be recognized easily by their use of the “.world”

Session hijacking, sometimes also known as cookie hijacking is the exploitation of a valid computer session—sometimes also called a session key—to gain unauthorized access to information or services in a computer system.

- Advertisement - Google News

Malvertisers using different methods for hijacking including redirected via a JavaScript, popups that redirect to new windows. The recent malvertising campaign that leans on pop-ups as the primary hijack mechanism.

eGobbler  Campaign Hijacked Over 500 Million Users

eGobbler  thread actors mainly leverage the technique called cloaking and some of the other obfuscation to evade the payload detection and make the payload looks like legitimate.

Researchers uncovered that malicious code within the payload has hard-coded logic that targets iOS.

Main hijacking mechanism of the payload was pop-up based which is an advantage for threat actors since the built-in pop-up blocker failed to
consistently.

According to confiant, “From here we underwent the tedious process of reverse engineering the payload, where we discovered techniques that took advantage of iOS Chrome’s detection around user activated pop-up detection, resulting in the circumvention of pop-up blocking. “

This Chrome bug is still unpatched and the active exploits targeting various targets around the world.

The malvertising exploits leveraged by eGobbler to bypass the standard ad sandboxing attributes.

“We believe that this exploit was key in magnifying the impact of this attack. Where standard sandboxing rules like the ones above would ultimately succeed in blocking certain redirections, they consistently failed to protect users from this campaign on iOS Chrome.” Researchers said.’

It campaign mainly targeting US-based, but European publishers saw a significant impact as well with the life span of 24–48hour range.

“The campaign saw a strategic pivot on April 14 to another platform and is currently still active under “.site” TLD landing pages. With half a billion user sessions impacted”.

You can follow us on LinkedinTwitter, Facebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

Hackers Compromise iOS & Android Devices by Dropping Malware Over Hijacked WiFi Routers

Apple Released Security Updates for iOS, Safari, tvOS, iTunes & Fixed Several Vulnerabilities

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Gunra Ransomware’s Double‑Extortion Playbook and Global Impact

Gunra Ransomware, has surfaced as a formidable threat in April 2025, targeting Windows systems...

Hackers Exploit 21 Apps to Take Full Control of E-Commerce Servers

Cybersecurity firm Sansec has uncovered a sophisticated supply chain attack that has compromised 21...

Hackers Target HR Departments With Fake Resumes to Spread More_eggs Malware

The financially motivated threat group Venom Spider, also tracked as TA4557, has shifted its...

RomCom RAT Targets UK Organizations Through Compromised Customer Feedback Portals

The Russian-based threat group RomCom, also known as Storm-0978, Tropical Scorpius, and Void Rabisu,...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Gunra Ransomware’s Double‑Extortion Playbook and Global Impact

Gunra Ransomware, has surfaced as a formidable threat in April 2025, targeting Windows systems...

Hackers Exploit 21 Apps to Take Full Control of E-Commerce Servers

Cybersecurity firm Sansec has uncovered a sophisticated supply chain attack that has compromised 21...

Hackers Target HR Departments With Fake Resumes to Spread More_eggs Malware

The financially motivated threat group Venom Spider, also tracked as TA4557, has shifted its...