Hijacking Archives

Chrome DevTools Technique Enables Authenticated Session Hijacking in Live Windows Browsers

14Aug

By RBNo Comments

News

Chrome DevTools Technique Enables Authenticated Session Hijacking in Live Windows Browsers

Cybersecurity researchers have described a post-exploitation technique that allows an operator to access cookies, saved data, and authenticated browser sessions by enabling the Chrome DevTools Protocol (CDP) inside a running Google Chrome or Microsoft Edge process on Windows. The method does not entail taking advantage of a security flaw in Chrome or Edge, and it assumes that an operator already has code execution on the Windows host. Compared to a remotely exploitable browser bug, the technique's post-compromise situation is more limited due to the requirement for prior code execution and adequate access to alter the target process. According to SpecterOps, defenders can use Sysmon Event IDs 8 and 10 to search for indications of process injection directed at chrome.exe and msedg...

Hackers Hijack Blender 3D Assets to Deploy StealC V2 Data-Stealing Malware

25Nov

By RBNo Comments

News

Hackers Hijack Blender 3D Assets to Deploy StealC V2 Data-Stealing Malware

Cybersecurity experts have revealed information on a recent campaign that used Blender Foundation files to distribute StealC V2, an information stealer. Malicious implants are part of this continuous operation, which has been going on for at least six months.According to a revelation provided with The Hacker News by Morphisec researcher Shmuel Uzan, blend files on platforms such as CGTrader. These 3D model files, which are intended to run embedded Python scripts when opened in Blender—a free, open-source 3D creation suite—are downloaded by users without their knowledge. According to the cybersecurity firm, the activity is comparable to a previous effort connected to Russian-speaking threat actors that targeted the online gaming community by posing as the Electronic Frontier Found...

Fake Madgicx Plus and SocialMetrics Extensions Are Hijacking Meta Business Accounts

11Sep

By RBNo Comments

News

Fake Madgicx Plus and SocialMetrics Extensions Are Hijacking Meta Business Accounts

Two new attacks have been revealed by cybersecurity experts that use malicious advertisements and phony websites to serve phony browser extensions and steal private information. According to Bitdefender, the purpose of the malvertising effort is to promote phony "Meta Verified" browser extensions called SocialMetrics Pro that make the promise that they can unlock the blue check badge for Instagram and Facebook profiles. The aforementioned extension has been found to serve at least 37 malicious advertisements. According to the Romanian cybersecurity provider, the malicious advertisements come with a video instruction that walks viewers through the process of downloading and installing a browser extension that promises to unlock Facebook's blue verification tick or other unique featur...

Discord Invite Link Hijacking Delivers AsyncRAT and Skuld Stealer Targeting Crypto Wallets

16Jun

By RBNo Comments

News

Discord Invite Link Hijacking Delivers AsyncRAT and Skuld Stealer Targeting Crypto Wallets

A new malware operation is using a flaw in Discord's invitation mechanism to spread the AsyncRAT remote access trojan and the information-stealing program Skuld. Through vanity link registration, the attackers were able to take control of the links and covertly reroute users from reliable sources to malicious servers, according to a technical report from Check Point. To covertly distribute AsyncRAT and a customized Skuld Stealer that targets cryptocurrency wallets, the attackers used a combination of time-based evasions, multi-stage loaders, and the ClickFix phishing tactic. The problem with Discord's invite method is that it gives hackers the ability to steal invite links that have expired or been removed and covertly reroute unwary users to malicious servers that they control. ...

Experts Uncover 70,000 Hijacked Domains in Widespread ‘Sitting Ducks’ Attack Scheme

15Nov

By RBNo Comments

News

Experts Uncover 70,000 Hijacked Domains in Widespread ‘Sitting Ducks’ Attack Scheme

Sitting Ducks is an attack tactic that has been used for years by a number of threat actors to take over legitimate domains and use them in investment fraud schemes and phishing attacks. According to Infoblox, around 9% (70,000) of the over 800,000 vulnerable registered domains it discovered over the previous three months have since been hijacked. In a comprehensive analysis published with The Hacker News, the cybersecurity firm claimed that since 2018, cybercriminals have exploited this mechanism to take over tens of thousands of domain names. Governmental organizations, non-profits, and well-known brands are examples of victim domains read more about Experts Uncover 70000 Hijacked Domains in Widespread 'Sitting Ducks' Attack Scheme. Get up to date on the latest cybersecurity ne...

New TunnelVision Attack Allows Hijacking of VPN Traffic via DHCP Manipulation

10May

By RBNo Comments

News

New TunnelVision Attack Allows Hijacking of VPN Traffic via DHCP Manipulation

Researchers have described how to circumvent virtual private networks (VPNs) using a method called TunnelVision that enables threat actors to eavesdrop on victim network traffic simply by sharing a local network. The CVE-2024-3661 (CVSS score: 7.6) has been assigned to the "decloaking" technique. It affects all operating systems with support for DHCP option 121 routes and DHCP clients implemented. Fundamentally, TunnelVision is the process of sending data across a VPN without encrypting it, using a DHCP server that has been configured by an attacker and the classless static route option 121 to establish a route on the VPN user's routing table. It also results from the fact that such option messages are vulnerable to manipulation because the DHCP protocol does not authenticate the...

China-Linked ‘Muddling Meerkat’ Hijacks DNS to Map Internet on Global Scale

30Apr

By RBNo Comments

News

China-Linked ‘Muddling Meerkat’ Hijacks DNS to Map Internet on Global Scale

Since October 2019, a previously unreported cyber threat known as Muddling Meerkat has been seen engaging in complex domain name system (DNS) operations in an apparent attempt to get around security barriers and do network reconnaissance worldwide. The threat actor, according to cloud security company Infoblox, is probably connected to the People's Republic of China (PRC) and has the ability to manage the Great Firewall (GFW), which filters access to foreign websites and controls internet traffic into and out of the nation. The reference to their "bewildering" operations and their misuse of DNS open resolvers, or DNS servers that allow recursive queries from any IP address, to transmit requests from the Chinese IP space is the reason behind the term. The business stated in a stud...

Researchers Detail Multistage Attack Hijacking Systems with SSLoad, Cobalt Strike

25Apr

By RBNo Comments

News

Researchers Detail Multistage Attack Hijacking Systems with SSLoad, Cobalt Strike

Researchers studying cybersecurity have uncovered a persistent campaign of attacks that uses phishing emails to spread malware known as SSLoad. Securonix has dubbed the campaign FROZEN#SHADOW. It also includes the use of the ConnectWise ScreenConnect remote desktop software and Cobalt Strike. Security experts Den Iuzvyk, Tim Peck, and Oleg Kolesnikov stated in a paper shared with The Hacker News that "SSLoad is designed to stealthily infiltrate systems, gather sensitive information, and transmit its findings back to its operators." To be persistent and evade detection, SSLoad installs a number of backdoors and payloads once inside the system read more Researchers Detail Multistage Attack Hijacking Systems with SSLoad and Cobalt Strike. Get up to date on the latest cybersecurit...

AWS Patches Critical ‘FlowFixation’ Bug in Airflow Service to Prevent Session Hijacking

22Mar

By RBNo Comments

News

AWS Patches Critical ‘FlowFixation’ Bug in Airflow Service to Prevent Session Hijacking

Researchers studying cybersecurity have disclosed information about a security flaw that has since been fixed in Amazon Web Services (AWS) Managed Workflows for Apache Airflow (MWAA). This flaw might allow a hostile actor to take control of victims' sessions and execute code remotely on underlying instances. Tenable has given the vulnerability, which AWS is currently fixing, the codename FlowFixation. Senior security researcher Liv Matan stated in a technical analysis that the attacker may have added configurations, accessed connection strings, and activated directed acyclic graphs (DAGS) after gaining control of the victim's account. Such activities may, in certain cases, lead to lateral transfer to other services and RCE on the instance supporting the MWAA read more AWS Patches...

New Variant of DLL Search Order Hijacking Bypasses Windows 10 and 11 Protections

3Jan

By RBNo Comments

News

New Variant of DLL Search Order Hijacking Bypasses Windows 10 and 11 Protections

Researchers studying security have discovered a novel form of dynamic link library (DLL) search order hijacking that threat actors might employ to get around security measures and execute malicious code on Microsoft Windows 10 and Windows 11 platforms. The cybersecurity company Security Joes stated in a new study that was privately shared with The Hacker News that the strategy "leverages executables commonly found in the trusted WinSxS folder and exploits them via the classic DLL search order hijacking technique." By doing this, adversaries can, as has been seen in the past, insert potentially vulnerable binaries into the attack chain and do away with the requirement for elevated privileges read more New Variant of DLL Search Order Hijacking Bypasses Windows 10 and 11 Protections. ...