Saturday, October 12, 2024
HomeAppleeGobbler Malvertising Campaign let Hackers Hijack 500 Millions of iOS Users Sessions...

eGobbler Malvertising Campaign let Hackers Hijack 500 Millions of iOS Users Sessions Using Chrome Bug

Published on

Malware protection

Researchers discovered a recent malvertising campaign from eGobbler  threat actor that targets millions of iOS users to hijack their sessions by leverage chrome vulnerability.

Attackers trick the targeted iOS users to redirect into Malicious lading page and this campaign can be recognized easily by their use of the “.world”

Session hijacking, sometimes also known as cookie hijacking is the exploitation of a valid computer session—sometimes also called a session key—to gain unauthorized access to information or services in a computer system.

- Advertisement - SIEM as a Service

Malvertisers using different methods for hijacking including redirected via a JavaScript, popups that redirect to new windows. The recent malvertising campaign that leans on pop-ups as the primary hijack mechanism.

eGobbler  Campaign Hijacked Over 500 Million Users

eGobbler  thread actors mainly leverage the technique called cloaking and some of the other obfuscation to evade the payload detection and make the payload looks like legitimate.

Researchers uncovered that malicious code within the payload has hard-coded logic that targets iOS.

Main hijacking mechanism of the payload was pop-up based which is an advantage for threat actors since the built-in pop-up blocker failed to
consistently.

According to confiant, “From here we underwent the tedious process of reverse engineering the payload, where we discovered techniques that took advantage of iOS Chrome’s detection around user activated pop-up detection, resulting in the circumvention of pop-up blocking. “

This Chrome bug is still unpatched and the active exploits targeting various targets around the world.

The malvertising exploits leveraged by eGobbler to bypass the standard ad sandboxing attributes.

“We believe that this exploit was key in magnifying the impact of this attack. Where standard sandboxing rules like the ones above would ultimately succeed in blocking certain redirections, they consistently failed to protect users from this campaign on iOS Chrome.” Researchers said.’

It campaign mainly targeting US-based, but European publishers saw a significant impact as well with the life span of 24–48hour range.

“The campaign saw a strategic pivot on April 14 to another platform and is currently still active under “.site” TLD landing pages. With half a billion user sessions impacted”.

You can follow us on LinkedinTwitter, Facebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

Hackers Compromise iOS & Android Devices by Dropping Malware Over Hijacked WiFi Routers

Apple Released Security Updates for iOS, Safari, tvOS, iTunes & Fixed Several Vulnerabilities

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Threat Actor ProKYC Selling Tools To Bypass Two-Factor Authentication

Threat actors are leveraging a newly discovered deepfake tool, ProKYC, to bypass two-factor authentication...

Mozilla Warns Of Firefox Zero-Day Actively Exploited In Cyber Attacks

A critical use-after-free vulnerability affecting Firefox and Firefox Extended Support Release (ESR) is being...

SpyCloud Embeds Identity Analytics in Cybercrime Investigations Solution to Accelerate Insider and Supply Chain Risk Analysis & Threat Actor Attribution

IDLink, SpyCloud’s new automated digital identity correlation capability, is now core to its industry-leading...

Abusix and Red Sift Form New Partnership, Leveraging Automation to Mitigate Cyber Attacks

The agreement has marked over 600,000 fraudulent domains for takedown in just two months...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

Threat Actor ProKYC Selling Tools To Bypass Two-Factor Authentication

Threat actors are leveraging a newly discovered deepfake tool, ProKYC, to bypass two-factor authentication...

Hackers Exploiting Zero-day Flaw in Qualcomm Chips to Attack Android Users

Hackers exploit a zero-day vulnerability found in Qualcomm chipsets, potentially affecting millions worldwide.The flaw,...

Foxit PDF Reader Vulnerability Let Attackers Execute Arbitary Code

Researchers recently disclosed six new security vulnerabilities across various software, as one critical vulnerability...