Hackers Using Malicious JavaScript Samples to Steal Sensitive Data

Is your online data safe? A recent study by Unit 42 researchers reveals a disturbing trend: JavaScript malware is evolving, employing sophisticated techniques to steal sensitive information like passwords and credit card numbers. 

Unit 42 researchers are the elite cyber sleuths of Palo Alto Networks, a leading cybersecurity company.

Evading the Watchful Eye:

Traditional static and dynamic analysis methods used by security tools often struggle against these new threats. 

Obfuscation, unusual DOM interactions, and selective payload detonation are just a few tricks these malicious scripts employ to fly under the radar.

Where the Data Goes:

The research identified several exfiltration methods used by the malware:

• Phishing Pages: These deceptively legitimate-looking websites trick users into surrendering their information.
• Skimming Sites: Attackers inject malicious scripts into compromised websites, capturing data as users interact with them.
• Chat and Survey APIs: Abusing legitimate APIs designed for communication and data collection provides a seemingly innocuous channel for stolen information to flow.

The malware authors are becoming increasingly creative in hiding their exfiltration activities:

• Dynamic HTML Generation: The code that steals data is created on the fly, making it difficult to detect statically.
• Image-based Exfiltration: Hidden images with encoded data are loaded, sending the stolen information to the attacker without raising suspicion.
• Keyword Triggers: The malware only activates when specific keywords are present, suggesting it targets specific user actions.

Unit 42 researchers developed advanced analysis techniques to track information flows within JavaScript code, exposing these stealthy exfiltration attempts. 

For Website Owners:

• Keep software updated: Patching vulnerabilities promptly is crucial to prevent attackers from gaining a foothold.
• Monitor exfiltration endpoints: Be vigilant for suspicious activity on your servers and hosting platforms.

For Users:

• Be cautious with online forms and links: Scrutinize websites before entering sensitive information.
• Use security software: Invest in a robust security solution that protects against online threats.
• Keep software updated: Patching vulnerabilities on your devices minimizes attack vectors