Saturday, June 15, 2024

Hackers Using Fake Google Chrome Error Screens To Inject Malware

Researchers detect a new malware campaign that uses a web page with fake Google Chrome error screens, and the campaign actively distributing malware since Feb 2023.

With the help of social engineering techniques, threat actors trick victims into executing the malware on the system. In this case, several Japanese websites are compromised to distribute the malware.

The Malware eventually drops a Monero miner with the function of the following:

  • Copy itself to C:\Program Files\Google\Chrome under the name updater.exe
  • Launch legitimate conhost.exe and process injection
  • Persisted using task scheduler and registry
  • Windows Defender exclusion settings
  • Stop services related to Windows Update
  • Interfering with communication of security products by rewriting the Hosts file.

Malware Infection Process:

Attackers compromised and defaced several legitimate websites, and the malicious code was injected with the help of the following parameters.

The link has a mtizndu2 parameter and is supposed to be a lowercase MTIzNDU2 base 64 encoded version of 123456.

In this case, Script tags load and execute JavaScript code of the following and the attackers use some obstruction technique to analyze the code.

The following code has using for this attack:

According to the NTT Data report, “In addition to access control using cookies, the loaded JavaScript code contains a function to narrow down the target and a process to redirect to a URL that displays a fake error screen.”

Attackers also used a Cookie key (c122eba0264bfd7e383f015cecf59fbd) for access control, and the MD5 value is “yagamilight” for the same.

In the Results, victims will see a fake Error screen of the following; JavaScript code downloads a ZIP file.

The Zip file is named as ” chromium-patch-nightly” and pretends to be a patch update for Chrome.

The language of the fake error screen displayed varies depending on the website to be defaced. In addition to Japanese, SOC has confirmed Spanish and Korean and supports multiple languages. Researchers said.

Researchers believe that some of the websites that have been defaced include Japanese websites, and the impact is widespread and serious. It may continue in the future, so be careful.

IoCs

  • 38[.]147.165.60
  • 103[.]150.180.49
  • 156[.]251.189.56
  • 38[.]147.165.50
  • 162[.]19.139.184
  • yhdmb[.]xyz
  • fastjscdn[.]org
  • chromelistcdn[.]cloud
  • chrome-error[.]co
  • xmr.2miners[.]com

Building Your Malware Defense Strategy – Download Free E-Book

Also Read:

Website

Latest articles

Sleepy Pickle Exploit Let Attackers Exploit ML Models And Attack End-Users

Hackers are targeting, attacking, and exploiting ML models. They want to hack into these...

SolarWinds Serv-U Vulnerability Let Attackers Access sensitive files

SolarWinds released a security advisory for addressing a Directory Traversal vulnerability which allows a...

Smishing Triad Hackers Attacking Online Banking, E-Commerce AND Payment Systems Customers

Hackers often attack online banking platforms, e-commerce portals, and payment systems for illicit purposes.Resecurity...

Threat Actor Claiming Leak Of 5 Million Ecuador’s Citizen Database

A threat actor has claimed responsibility for leaking the personal data of 5 million...

Ascension Hack Caused By an Employee Who Downloaded a Malicious File

Ascension, a leading healthcare provider, has made significant strides in its investigation and recovery...

AWS Announced Malware Detection Tool For S3 Buckets

Amazon Web Services (AWS) has announced the general availability of Amazon GuardDuty Malware Protection...

Hackers Exploiting MS Office Editor Vulnerability to Deploy Keylogger

Researchers have identified a sophisticated cyberattack orchestrated by the notorious Kimsuky threat group.The...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles