Friday, November 1, 2024
HomeComputer SecurityAnonymous Hacker Group Destroyed 1 Million Web Pages that Owned by Coca-Cola,...

Anonymous Hacker Group Destroyed 1 Million Web Pages that Owned by Coca-Cola, ToysRUs, McDonald’s

Published on

Malware protection

Anonymous Threat actor group compromised hundreds of websites and destroyed nearly 1 million Israeli based webpages that belong to some of the leading brands including Coca-Cola, ToysRUs, McDonald’s.

This breach also affected some of the leading websites in Isreal including
Ynet and Calcalist where hackers displayed political messages.

Hackers mostly compromised the well-known brand websites that launched for Isreal users such as co.il address -mcdonalds.co.il, cocacola.co.iletc.

- Advertisement - SIEM as a Service

A vulnerability that existing the third party accessibility plugin-in called nagich.co.il loaded malicious JavaScript code that corrupted the site and let attackers took advantage to exploit and compromise the millions of web pages.

The nagich is a disabled page accessibility plugin allowed to access over 1 million Israeli web pages so this critical vulnerability existing in nagich plug-in leads to compromise all these web pages.

Hundreds of Websites compromised by hackers due to the nagich team lethargic action in order to fix this vulnerability.

Initially, this breach related vulnerability posted by a security researcher Yuval Adam in Twitter where he says nagich script implemented Isreali websites are hacked and displays the following message.

The way Third Party Plugin Abused by Hackers

Since the nagich accessibility Plugin contains a severe vulnerability let hackers to replace the malicious code with an embedded link.

It was successfully achieved by taking control of a record on a DNS server of the nagich service domain name that allows attackers to redirect traffic to a server that it controls rather than to the original server.

Ran Bar-Zik Programmer and a security researcher wrote in “Internet israel” who wanted to reach the nagich.co.il domain name where the accessibility script was located were redirected to the IP address ][172.81.182.63] instead of the correct IP address of the server: [212.179.58.35].”

The nagich site is not just a website. Is a site that provides an accessibility plugin. An accessibility plugin is a small Java script that runs on a site that chooses to use this service and gives it all kinds of options.

Once we gave permission to other functions then it has an ability to run code on our site means that, it can do anything with our site.

As soon as the attackers diverted the traffic from the legitimate server to their illegitimate server, they injected malicious code that made defacement, that’s all. Researcher said.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS...

ATPC Cyber Forum to Focus on Next Generation Cybersecurity and Artificial Intelligence Issues

White House National Cyber Director, CEOs, Key Financial Services Companies, Congressional and Executive Branch...

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan...

Konni APT Hackers Attacking Organizations with New Spear-Phishing Tactics

The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

Google Chrome Security, Critical Vulnerabilities Patched

Google has updated its Chrome browser, addressing critical vulnerabilities that posed potential risks to...

Notorious WrnRAT Delivered Mimic As Gambling Games

WrnRAT is a new malware attack that cybercriminals have deployed by using popular gambling...

New Windows Downgrade Attack Let Hackers Downgrade Patched Systems To Exploits

The researcher discovered a vulnerability in the Windows Update process that allowed them to...