Tuesday, April 29, 2025
HomeCyber Security NewsHackers Exploiting Selenium Grid Tool To Deploy Exploit Kit & Proxyjacker

Hackers Exploiting Selenium Grid Tool To Deploy Exploit Kit & Proxyjacker

Published on

SIEM as a Service

Follow Us on Google News

Two campaigns targeting Selenium Grid’s default lack of authentication are underway, as threat actors are exploiting this vulnerability to deploy malicious payloads, including exploit kits, cryptominers, and proxyjackers.

Selenium Grid’s widespread use among developers, coupled with its default lack of security, makes it an attractive target for attackers seeking to compromise systems and gain unauthorized access.

The campaigns are leveraging Selenium Grid’s ability to execute code on remote machines to distribute and execute malicious software, posing a significant threat to organizations relying on this tool for testing and automation.

- Advertisement - Google News
Attack Flow of Each Campaign

The misconfigured Selenium Grid instance allowed attackers to exploit a lack of authentication.

In a specific attack, the attackers injected a base64-encoded Python script into the “goog:chromeOptions” configuration, which was executed due to the specified Python3 binary in the WebDriver configuration.

Following the disabling of shell command history logging, the script proceeded to download a reverse shell script from a remote server.

The downloaded script, known as GSocket, established an encrypted TCP connection between the compromised system and a remote server, enabling the attackers to execute commands on the infected machine.

Reverse Shell Script

A malicious script “pl” retrieved from a command and control server performs various system checks and retrieves additional payloads depending on the architecture, and then stops specific Docker containers and sets the installation path.

According to Cado Security Labs, it retrieves IPRoyal Pawn and EarnFM payloads, likely used for selling the user’s internet bandwidth as a proxy service (IPRoyal Pawns) and for other malicious purposes.

Furthermore, “pl” contains a base64-encoded script “tm” that checks for root privileges and system information and installs Docker if missing. It then retrieves and configures Docker images for “traffmonetizer” and “WatchTower.”

Screenshot of Function tm Performing System Checks

The threat actor employed a multi-stage attack, starting with a base64-encoded Python script injected into Chrome, which decoded into a Bash script, prepared the system by creating directories, manipulating environment variables, and checking for existing processes.

It then downloaded an ELF binary packed with UPX and removed its header to evade detection.

The unpacked binary, written in Golang, attempted to exploit CVE-2021-4043 to gain root privileges.

It established connections to Tor nodes for C2 communication, dropped cryptomining binaries, set up cron jobs for persistence and also created temporary directories containing files related to the cryptomining process.

.xdiag Directory

The SHC-compiled ELF binary, “Top,” is a Bash script that uses environment variables to determine its behavior.

If “ABWTRX” is set, it exits. If “AAZHDE” is not set, it modifies the PATH, sets up cleanup traps, terminates “perfctl” processes, and removes temporary files.

It then executes the “top” command to display system processes. This script was used in a recent campaign to exploit misconfigured Selenium Grid instances.

This attack highlights the importance of proper authentication and configuration for Selenium Grid to prevent unauthorized access and malicious activity.

Varshini
Varshini
Varshini is a Cyber Security expert in Threat Analysis, Vulnerability Assessment, and Research. Passionate about staying ahead of emerging Threats and Technologies.

Latest articles

Researchers Uncover SuperShell Payloads and Various Tools in Hacker’s Open Directories

Cybersecurity researchers at Hunt have uncovered a server hosting advanced malicious tools, including SuperShell...

Cyber Espionage Campaign Targets Uyghur Exiles with Trojanized Language Software

A sophisticated cyberattack targeted senior members of the World Uyghur Congress (WUC), the largest...

Konni APT Deploys Multi-Stage Malware in Targeted Organizational Attacks

A sophisticated multi-stage malware campaign, potentially orchestrated by the North Korean Konni Advanced Persistent...

Outlaw Cybergang Launches Global Attacks on Linux Environments with New Malware

The Outlaw cybergang, also known as “Dota,” has intensified its global assault on Linux...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Researchers Uncover SuperShell Payloads and Various Tools in Hacker’s Open Directories

Cybersecurity researchers at Hunt have uncovered a server hosting advanced malicious tools, including SuperShell...

Cyber Espionage Campaign Targets Uyghur Exiles with Trojanized Language Software

A sophisticated cyberattack targeted senior members of the World Uyghur Congress (WUC), the largest...

Konni APT Deploys Multi-Stage Malware in Targeted Organizational Attacks

A sophisticated multi-stage malware campaign, potentially orchestrated by the North Korean Konni Advanced Persistent...