Cybersecurity researchers have detailed an up to date model of a complicated fingerprinting and redirection toolkit known as WoofLocker that is engineered to conduct tech help scams.
The delicate site visitors redirection scheme was first documented by Malwarebytes in January 2020, leveraging JavaScript embedded in compromised web sites to carry out anti-bot and internet site visitors filtering checks to serve next-stage JavaScript that redirects customers to a browser locker (aka browlock).
This redirection mechanism, in flip, makes use of steganographic tips to hide the JavaScript code inside a PNG picture that is served solely when the validation part is profitable. Ought to a consumer be detected as a bot or not attention-grabbing site visitors, a decoy PNG file with out the malicious code is used.
WoofLocker is also called 404Browlock because of the truth that visiting the browlock URL immediately with out the suitable redirection or one-time session token leads to a 404 error web page.
The cybersecurity agency’s newest evaluation reveals that the marketing campaign remains to be ongoing.
“The ways and methods are very comparable, however the infrastructure is now extra sturdy than earlier than to defeat potential takedown makes an attempt,” Jérôme Segura, director of menace intelligence at Malwarebytes, mentioned.
“It’s simply as troublesome to breed and research the redirection mechanism now because it was then, particularly in gentle of latest fingerprinting checks” to detect the presence of digital machines, sure browser extensions, and safety instruments.
A majority of the websites loading WoofLocker are grownup web sites, with the infrastructure utilizing internet hosting suppliers in Bulgaria and Ukraine that give the menace actors stronger safety towards takedowns.
The first aim of browser lockers is to get focused victims to name for help to resolve (non-existent) pc issues and acquire distant management over the pc to draft an bill that recommends affected people to pay for a safety resolution to deal with the issue.
“That is dealt with by third-parties through fraudulent name facilities,” Segura famous again in 2020. “The menace actor behind the site visitors redirection and browlock will receives a commission for every profitable lead.”
The precise identification of the menace actor stays unknown and there’s proof preparations for the marketing campaign have been underway as early as 2017.
“Not like different campaigns that depend on buying advertisements and taking part in whack-a-mole with internet hosting suppliers and registrars, WoofLocker is a really steady and low upkeep enterprise,” Segura mentioned. “The web sites internet hosting the malicious code have been compromised for years whereas the fingerprinting and browser locker infrastructure seems to be utilizing strong registrar and internet hosting suppliers.”
The disclosure comes as the corporate detailed a brand new malvertising an infection chain that includes utilizing bogus advertisements on serps to direct customers trying to find distant entry packages and scanners to booby-trapped web sites that result in the deployment of stealer malware.
What units this marketing campaign aside is its means to fingerprint guests utilizing the WEBGL_debug_renderer_info API to assemble the sufferer’s graphics driver properties to type actual browsers from crawlers and digital machines and exfiltrate the info to a distant server to be able to decide the subsequent plan of action.
“Through the use of higher filtering earlier than redirecting potential victims to malware, menace actors make sure that their malicious advertisements and infrastructure stay on-line longer,” Segura mentioned. “Not solely does it make it harder for defenders to determine and report such occasions, it additionally seemingly has an affect on takedown actions.”
The event additionally follows new analysis which discovered that web sites belonging to U.S. authorities businesses, main universities, {and professional} organizations have been hijacked over the past 5 years and used to push rip-off provides and promotions through “poison PDF” information uploaded to the portals.
Many of those scams are geared toward youngsters and try and trick them into downloading apps, malware, or submitting private particulars in change for non-existent rewards in on-line gaming platforms resembling Fortnite and Roblox.
