Tuesday, March 19, 2024

Operation Poisoned News – Hackers Deliver Malware Targeting iOS Users Using Local News Links

A new campaign dubbed Operation Poisoned News that uses news local news sites links to deploy malware called lightSpy on the user’s iOS devices.

Attackers posted the news articles in various forums, by clicking on the link it takes users to the news sites, but they also have hidden iframe that loads malicious code.

The malicious code is capable of exploiting vulnerabilities present in iOS 12.1 and 12.2, clicking on those links leads to the installation of malware lightSpy on the iOS devices.

Poisoned News Campaign

The lightSpy is the backdoor module that allows attackers to execute the code remotely and to manipulate files in the affected device.

Security researchers from Trend Micro observed the watering hole attack targeting iOS users. The links posted by the attackers include three iframes.

The only visible link is the original news website, with the other two invisible links, one used for analytics purposes and another site hosting exploits.

Here you can find the three iframe

Operation Poisoned News
iframes

The attack particularly targets Hong Kong residents, attackers posted links on various popular forums to infect more victims.

To trick the user’s attackers posted the links under the topics such as sex-related, clickbait-type headlines, or news related to the COVID-19 disease.

Researchers also observed another attack type in which the attackers copied the legitimate site and injected with a malicious iframe.

Operation Poisoned News
Second method

The malware modules for exfiltrating data infecting device, that includes;

  • Connected WiFi history
  • Contacts
  • GPS location
  • Hardware information
  • iOS keychain
  • Phone call history
  • Safari and Chrome browser history
  • SMS messages
  • Available WiFi network
  • Local network IP addresses
  • Telegram
  • QQ
  • WeChat

Exploiting iOS 12.1 and 12.2

The exploit used in the attack affects iOS 12.1 and 12.2, it attacks a variety of iphone models from the iPhone 6S up to the iPhone X.

Operation Poisoned News
Versions

“The full exploit chain involves a silently patched Safari bug (which works on multiple recent iOS versions) and a customized kernel exploit,” researchers told.

Once the attacker gained access to the device they install sophisticated spyware to maintain control over the device. The spyware modules designed specifically to exfiltrate the data.

Here are the complete attack chain and modules used

Attack Chain

Researchers also noted an Android counterpart to lightSpy which is called as dmsSpy, the variant was distributed in Telegram channels as apps in 2019.

The dmsSpy malware also includes various functions like traditional malware. It steals more sensitive information such as contacts, text messages, the user’s location, and the names of stored files.

Researchers have notified the vulnerabilities to Apple via Trend Micro’s Zero Day Initiative (ZDI) and to Telegram also, but no response received.

Website

Latest articles

Microsoft Deprecate 1024-bit RSA Encryption Keys in Windows

Microsoft has announced an important update for Windows users worldwide in a continuous effort...

Beware Of Free wedding Invite WhatsApp Scam That Steal Sensitive Data

The ongoing "free wedding invite" scam is one of several innovative campaigns aimed at...

Hackers Using Weaponized SVG Files in Cyber Attacks

Cybercriminals have repurposed Scalable Vector Graphics (SVG) files to deliver malware, a technique that...

New Acoustic Keyboard Side Channel Attack Let Attackers Steal Sensitive Data

In recent years, personal data security has surged in importance due to digital device...

Discontinued WordPress Plugin Flaw Exposes Websites to Cyber Attacks

A critical vulnerability was discovered in two plugins developed by miniOrange.The affected plugins,...

ShadowSyndicate Hackers Exploiting Aiohttp Vulnerability To Access Sensitive Data

A new Aiohttp vulnerability has been discovered, which the threat actor ShadowSyndicate exploits.Aiohttp...

Hackers Launching AI-Powered Cyber Attacks to Steal Billions

INTERPOL's latest assessment on global financial fraud uncovers the sophisticated evolution of cybercrime, fueled...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles