Researchers discovered a recent malvertising campaign from eGobbler threat actor that targets millions of iOS users to hijack their sessions by leverage chrome vulnerability.
Attackers trick the targeted iOS users to redirect into Malicious lading page and this campaign can be recognized easily by their use of the “.world”
Session hijacking, sometimes also known as cookie hijacking is the exploitation of a valid computer session—sometimes also called a session key—to gain unauthorized access to information or services in a computer system.
Malvertisers using different methods for hijacking including redirected via a JavaScript, popups that redirect to new windows. The recent malvertising campaign that leans on pop-ups as the primary hijack mechanism.
eGobbler Campaign Hijacked Over 500 Million Users
eGobbler thread actors mainly leverage the technique called cloaking and some of the other obfuscation to evade the payload detection and make the payload looks like legitimate.
Researchers uncovered that malicious code within the payload has hard-coded logic that targets iOS.
Main hijacking mechanism of the payload was pop-up based which is an advantage for threat actors since the built-in pop-up blocker failed to
consistently.
According to confiant, “From here we underwent the tedious process of reverse engineering the payload, where we discovered techniques that took advantage of iOS Chrome’s detection around user activated pop-up detection, resulting in the circumvention of pop-up blocking. “
This Chrome bug is still unpatched and the active exploits targeting various targets around the world.
The malvertising exploits leveraged by eGobbler to bypass the standard ad sandboxing attributes.
“We believe that this exploit was key in magnifying the impact of this attack. Where standard sandboxing rules like the ones above would ultimately succeed in blocking certain redirections, they consistently failed to protect users from this campaign on iOS Chrome.” Researchers said.’
It campaign mainly targeting US-based, but European publishers saw a significant impact as well with the life span of 24–48hour range.
“The campaign saw a strategic pivot on April 14 to another platform and is currently still active under “.site” TLD landing pages. With half a billion user sessions impacted”.
Related Read
