Researchers Expose PWA JavaScript Attack That Redirects Users to Adult Scam Apps
Researchers studying cybersecurity have uncovered a new campaign that uses malicious JavaScript injections to divert mobile site visitors to a Progressive Web App (PWA) fraud with adult content from China.
According to a Tuesday investigation by c/side researcher Himanshu Anand, the delivery mechanism is noteworthy even if the payload itself is nothing new—it's just another adult gambling fraud.
The malicious landing page is a full-fledged Progressive Web App (PWA), perhaps designed to evade standard browser security and keep users on the site longer.
The campaign's primary focus is on mobile users, specifically excluding desktop users. The activity has been characterized as a client-side assault that solely activates on mobile devices and makes use of third-party JavaScript.
...