Skip to content
Log In
Request Trial

Over 500 Million Chrome iOS Sessions Hijacked in Malvertising Campaign

By | Published

Confiant has spotted the known threat actor eGobbler back in action. This group is well-known for attempting its campaigns around holidays, which is when it assumes there will be increased consumer traffic.

But this go-around the group is exploiting a currently unpatched flaw in the Chrome for iOS browser, to bypass sandboxing and hijack user sessions. This means that iPhone and iPad users are directly targeted.

eGobbler has historically used the ".world" TLD for their landing media like pop-ups, but this campaign seems to be using ".site" TLDs for web-based content.

eGobbler's main session hijacking mechanism in this case, however, was pop-up based. This is a change in strategy since when a browser's pop-up blocker is working it will stop the pop-up from appearing. Session hijacking happens when a user is redirected to another site or landing page. Alternatively, a pop-up can appear that one can't exit out of. The served pages look like ads from well-known brands, but they aren't. If clicked, a malicious payload is then deployed to the user.

Confiant has said that they "discovered techniques that took advantage of iOS Chrome's detection around user activated pop-up detection, resulting in the circumvention of pop-up blocking." Since Chrome remains unpatched at the time of this writing, Confiant is not revealing the exact code details of how this is done. That the exploit is able to bypass that need for user interaction should be impossible according to the same-origin policy (as it pertains to cross-origin iframes).

Read Complete Article: https://www.darkreading.com/application-security/malware-detection/over-500-million-chrome-ios-sessions-hijacked-in-massive-malvertising-campaign/a/d-id/750963

Share this story

Subscribe to our newsletter to stay up to date on the latest trends and emerging threats.

Take Us For A Spin

Request a trial and see how it feels to have Confiant on your side.

Request Trial