A new Web injections campaign that appeared in March 2023 used JavaScript into web pages to try to steal the banking data of over 50,000 users from 40 banks in North America, South America, Europe, and Japan.
See also: Malicious Google ads trick Mac users into installing Atomic Stealer malware
IBM's security team discovered this threat and reported that the campaign had been in the works since at least December 2022, when the malicious domains were purchased.
The attacks were carried out through scripts loaded by the attacker's broker, focusing on a specific page structure common to many banks, with the aim of intercepting user credentials and one-time passwords (OTPs).
By obtaining the above information, attackers can log in to the victim's bank account, block it by changing the security settings, and make unauthorized transactions.
The attack begins with the initial infection of the victim's device with malware. report doesn't go into the details of this stage, but it could be done through malicious advertising, fake emails, etc.
Once the victim visits the attackers' pirated or malicious websites, the malware injects a new script with a source attribute ('src') that points to an externally hosted script.
The malicious encrypted script is loaded into the victim's browser to modify the content , capture login credentials, and insert OTP passwords.
IBM says this extra step is unusual, as the majority of malware embeds web pages directly into the web page.
This new approach makes attacks more invisible, as static analysis checks are unlikely to identify the simplest payload script as malicious, while also allowing dynamic content delivery, allowing attackers to switch to new second-stage payloads if required.
See also: Malware and ransomware still pose the biggest threats in cyberspace
It is also worth noting that the malicious script resembles legitimate JavaScript content delivery services (CDN), using domains such as cdnjs[.]com and unpkg[.]com, to avoid detection. In addition, the script performs checks for specific products before executing. The script is dynamic, constantly adapting its behavior according to the instructions of the control server and communicating updates and receiving specific responses that guide its activity on the compromised device.
Many operational states determined by a “mlink” signal set by the server, including entering questions for phone numbers or OTP arrangements, displaying error messages, or simulating page loading, are part of its data theft strategy.
According to IBM, nine “mlink” variable values can be combined to instruct the script to perform specific data storage actions, so a diverse set of commands is supported.
Researchers discovered vague connections between this new campaign and DanaBot, a versatile banking trojan that has been around since 2018 and was recently observed spreading via spammy Google Search promoting fake Cisco Webex.
According to IBM, the campaign is still ongoing, so increased vigilance is recommended when using online banking portals and applications.
See also: Raspberry Pi: Uses electromagnetic waves to detect malware
Ways of protection
One of the most effective techniques is to use up-to-date security software that can identify and remove web injection malware. software should be able to regularly monitor your system for any attacks and deal with them immediately.
Also, educating users about online can be very helpful. Users need to be aware of the techniques used by attackers and how to recognize the signs of a web injection attack.
Using a content management system (CMS) that is regularly updated and has built-in security features can help protect against web injection attacks.
Finally, using techniques such as input validation and securing communication between the server and client over HTTPS can prevent malicious code from executing on the user's computer.
Source: bleepingcomputer
