#MaliciousJavaScript

China-Linked TAG-112 Targets Tibetan Media with Cobalt Strike Espionage Campaign

by

November 22, 2024 at 12:17PM A China-linked group, TAG-112, compromised Tibetan media and university websites, delivering the Cobalt Strike toolkit via malicious JavaScript. Visitors were tricked into downloading disguised malware, highlighting ongoing cyber-espionage targeting Tibet. Although linked to a more advanced group (TAG-102), TAG-112 exhibits less sophistication in its attacks. ### Meeting Takeaways – Nov … Read more

Hackers inject malicious JS in Cisco store to steal credit cards, credentials

by

September 4, 2024 at 11:53AM Cisco’s online merchandise store is currently offline and undergoing maintenance due to a compromise with malicious JavaScript code that steals sensitive customer details during the checkout process. The attack appears to be a CosmicSting vulnerability, affecting the store’s ability to process transactions and potentially compromising customer data. Cisco has not … Read more

Hackers exploit LiteSpeed Cache flaw to create WordPress admins

by

May 7, 2024 at 05:48PM Hackers are exploiting vulnerabilities in outdated LiteSpeed Cache and Email Subscribers plugins for WordPress, creating rogue admin users and compromising sites. An unauthenticated cross-site scripting flaw, CVE-2023-40000, affects LiteSpeed Cache versions older than 5.7.0.1, while Email Subscribers plugin versions 5.7.14 and older are vulnerable to a critical SQL injection flaw, … Read more

Evasive Sign1 malware campaign infects 39,000 WordPress sites

by

March 21, 2024 at 12:02PM The Sign1 malware campaign has infected over 39,000 websites, injecting malicious scripts into WordPress sites by exploiting vulnerabilities or using brute force attacks. The malware uses time-based randomization and dynamic URLs to evade detection, redirects visitors to scam sites, and has evolved to become more resilient. Website owners are advised … Read more

Hacked WordPress Sites Abusing Visitors’ Browsers for Distributed Brute-Force Attacks

by

March 7, 2024 at 09:21AM Threat actors are launching distributed brute-force attacks on WordPress sites through malicious JavaScript injections, causing unauthorized access to target sites. This shift from crypto drainers to brute-force attacks may be driven by profit motives, as compromised sites can be monetized in various ways. Prior attacks have exploited vulnerabilities in WordPress … Read more

New JavaScript Malware Targeted 50,000+ Users at Dozens of Banks Worldwide

by

December 21, 2023 at 07:51AM A new JavaScript malware targets over 40 financial institutions worldwide, compromising users’ banking credentials via web injections. The campaign, detected by IBM Security Trusteer, uses dynamic tactics to bypass security measures and dissuade victims from logging in. Additionally, other online fraud schemes, including investment scams and phishing attacks impersonating postal … Read more

Watch Out: Attackers Are Hiding Malware in ‘Browser Updates’

by

October 17, 2023 at 12:49PM Threat actors are disguising malware as fake browser updates and spreading it through vulnerable websites. This tactic has been adopted by multiple threat clusters, including TA569. The malicious code is injected into legitimate websites and presents users with convincing browser update notifications. When users click “Update,” they unknowingly download malware. … Read more