Operation Poisoned News – Hackers Deliver Malware Targeting iOS Users Using Local News Links

A new campaign dubbed Operation Poisoned News that uses news local news sites links to deploy malware called lightSpy on the user’s iOS devices.

Attackers posted the news articles in various forums, by clicking on the link it takes users to the news sites, but they also have hidden iframe that loads malicious code.

The malicious code is capable of exploiting vulnerabilities present in iOS 12.1 and 12.2, clicking on those links leads to the installation of malware lightSpy on the iOS devices.

Poisoned News Campaign

The lightSpy is the backdoor module that allows attackers to execute the code remotely and to manipulate files in the affected device.

Security researchers from Trend Micro observed the watering hole attack targeting iOS users. The links posted by the attackers include three iframes.

The only visible link is the original news website, with the other two invisible links, one used for analytics purposes and another site hosting exploits.

Here you can find the three iframe

iframes

The attack particularly targets Hong Kong residents, attackers posted links on various popular forums to infect more victims.

To trick the user’s attackers posted the links under the topics such as sex-related, clickbait-type headlines, or news related to the COVID-19 disease.

Researchers also observed another attack type in which the attackers copied the legitimate site and injected with a malicious iframe.

Second method

The malware modules for exfiltrating data infecting device, that includes;

  • Connected WiFi history
  • Contacts
  • GPS location
  • Hardware information
  • iOS keychain
  • Phone call history
  • Safari and Chrome browser history
  • SMS messages
  • Available WiFi network
  • Local network IP addresses
  • Telegram
  • QQ
  • WeChat

Exploiting iOS 12.1 and 12.2

The exploit used in the attack affects iOS 12.1 and 12.2, it attacks a variety of iphone models from the iPhone 6S up to the iPhone X.

Versions

“The full exploit chain involves a silently patched Safari bug (which works on multiple recent iOS versions) and a customized kernel exploit,” researchers told.

Once the attacker gained access to the device they install sophisticated spyware to maintain control over the device. The spyware modules designed specifically to exfiltrate the data.

Here are the complete attack chain and modules used

Attack Chain

Researchers also noted an Android counterpart to lightSpy which is called as dmsSpy, the variant was distributed in Telegram channels as apps in 2019.

The dmsSpy malware also includes various functions like traditional malware. It steals more sensitive information such as contacts, text messages, the user’s location, and the names of stored files.

Researchers have notified the vulnerabilities to Apple via Trend Micro’s Zero Day Initiative (ZDI) and to Telegram also, but no response received.

Gurubaran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

Nearest Neighbor Attacks: Russian APT Hack The Target By Exploiting Nearby Wi-Fi Networks

Recent research has revealed that a Russian advanced persistent threat (APT) group, tracked as "GruesomeLarch"…

1 day ago

240+ Domains Used By PhaaS Platform ONNX Seized by Microsoft

Microsoft's Digital Crimes Unit (DCU) has disrupted a significant phishing-as-a-service (PhaaS) operation run by Egypt-based…

2 days ago

Russian TAG-110 Hacked 60+ Users With HTML Loaded & Python Backdoor

The Russian threat group TAG-110, linked to BlueDelta (APT28), is actively targeting organizations in Central…

2 days ago

Earth Kasha Upgraded Their Arsenal With New Tactics To Attack Organizations

Earth Kasha, a threat actor linked to APT10, has expanded its targeting scope to India,…

2 days ago

Raspberry Robin Employs TOR Network For C2 Servers Communication

Raspberry Robin, a stealthy malware discovered in 2021, leverages advanced obfuscation techniques to evade detection…

2 days ago

145,000 ICS Systems, Thousands of HMIs Exposed to Cyber Attacks

Critical infrastructure, the lifeblood of modern society, is under increasing threat as a new report…

2 days ago