A sophisticated website hijack campaign initially detected in February has seen a dramatic escalation, with security analysts now estimating that approximately 150,000 websites have been compromised.
The initial discovery flagged over 35,000 targeted websites. Himanshu Anand, a software engineer and security analyst at c/side, has continued to monitor the threat actor’s activities and uncovered new tactics and techniques employed in this expanding operation.
What’s new in this attack?
According to Anand’s latest findings, while the core method of attack remains consistent, the threat actor has introduced several notable changes.
UI/UX changes
While the UI of the injected malicious page has only undergone a slight redesign, the fundamental technique of using an iframe injection to display a full-screen overlay in the website visitor’s browser persists. This suggests the attackers are refining their approach to potentially evade less sophisticated detection mechanisms or to appear more legitimate to unsuspecting users.
Further analysis has revealed variations in the website hijack attack, with injected scripts and iframes designed to mimic well-known betting sites like Bet365. The attackers are often reusing official logos and branding to increase the plausibility of the fraudulent overlay.
HTML entity encoding
A development in this campaign is the use of HTML entity encoding within the injected code. In the static code, the malicious JavaScript is injected.
“This is an instance of HTML Entity encoding, a different way of obfuscating code. It makes the injected script less obvious at first glance,” Anand explained.
The analysis further uncovered JavaScript within the attack that decodes itself to reveal another layer of malicious intent. This ultimately results in another script being written to the compromised webpage.
Anand highlights that attackers “use obfuscation to hide the true nature of the script from quick scans or less sophisticated detections.”
This multi-layered obfuscation demonstrates the increasing sophistication of the threat actors involved.
Analysing the final JavaScript payload
Further scrutiny of the final JavaScript payload reveals several key aspects of the attack:
- Keyword-based detection logic
The script incorporates an array of keywords associated with betting, gambling, and casino brands in both English and Chinese. Examples provided include “bet365”, “WilliamHill”, “tyc”, “bwin”, “12bet”, “w88”, “宝威”, and “太阳城”.
The script then proceeds to examine the
tag of the current webpage against this predefined list. According to Anand, “Once a match is found, the script sets up an ID parameter (?id=) for use in the next stage of the redirect.” This keyword-based detection allows the attackers to target websites with content related to gambling, ensuring the injected overlay is contextually relevant.
<p>The malicious code also includes a function called handleViewportTag() along with a mutation observer and a setInterval call. These mechanisms work to repeatedly inject a mobile-friendly viewport meta tag. This ensures that the fullscreen overlay is displayed correctly and optimally on mobile devices, which are increasingly used for web Browse.</p>
<ul class="wp-block-list">
<li><strong>Fullscreen overlay and iframe injection</strong></li>
</ul>
<p>The attacker’s script generates a </p>
<div> element with the class “lbb”. This element is styled using CSS to cover the entire screen and is used to inject a fullscreen <iframe>. The consequence of this injection is that any visitor to a compromised website will be presented with the malicious gambling landing page instead of the intended, legitimate content.
<h3 id="redirect-destinations-and-scale-of-the-website-hijack-attack" class="rb-heading-index-2-18557 wp-block-heading">Redirect destinations and scale of the website hijack attack</h3>
<p>During their analysis, the researchers at c/side observed multiple redirect URLs used in this campaign. These include:</p>
<ul class="wp-block-list">
<li>hxxps://551007t[.]cc/</li>
<li>hxxps://t399229[.]com/</li>
<li>hxxps://www.wa38di[.]com:7443/other/restrictionIp?name=access-caveat (Previously seen in other campaigns)</li>
<li>hxxps://W88in[.]com</li>
<li>hxxps://b217102[.]cc/</li>
<li>hxxps://g977115[.]com/</li>
<li>hxxps://lucky298[.]com/</li>
</ul>
<p>Anand notes that “several of these sites selectively block traffic from specific regions, leading us to suspect the primary targets are Chinese-speaking users in China, Hong Kong, and the United States.”</p>
<p>By utilising public search tools such as PublicWWW, the researchers were able to cluster all websites containing the obfuscated script snippet. At the time of their analysis, this revealed over 150,000 unique infected websites. A live query of these infections can be viewed here.</p>
<p>“This attack demonstrates how threat actors constantly adapt, increasing their reach and using new layers of obfuscation. Client-side attacks like these are on the rise, with more and more findings every day,” Anand warns.</p>
<p>For website owners concerned about potential compromise, Anand advises, “If you suspect your site might be impacted, review all scripts for hidden HTML entity encoding or suspicious <iframe> injections. As always, ongoing vigilance and regular site auditing remain your best defenses against attacks like these.”</iframe></p>
<p><em>(Photo by Jakob Rosen)</em></p>
<p><strong>See also: </strong><strong>Critical security flaw uncovered in Next.js framework</strong></p>
<figure class="wp-block-image size-full is-resized"><img loading="lazy" decoding="async" width="728" height="90" src="https://www.developer-tech.com/wp-content/uploads/2022/04/cyber-expo-world-728-x-90-01.png" alt="" class="wp-image-42900" style="width:1105px;height:auto" srcset="https://www.developer-tech.com/wp-content/uploads/2022/04/cyber-expo-world-728-x-90-01.png 728w, https://www.developer-tech.com/wp-content/uploads/2022/04/cyber-expo-world-728-x-90-01-300x37.png 300w, https://www.developer-tech.com/wp-content/uploads/2022/04/cyber-expo-world-728-x-90-01-380x47.png 380w, https://www.developer-tech.com/wp-content/uploads/2022/04/cyber-expo-world-728-x-90-01-350x43.png 350w, https://www.developer-tech.com/wp-content/uploads/2022/04/cyber-expo-world-728-x-90-01-100x12.png 100w, https://www.developer-tech.com/wp-content/uploads/2022/04/cyber-expo-world-728-x-90-01-60x7.png 60w" sizes="auto, (max-width: 728px) 100vw, 728px"></figure>
<p><strong>Want to learn more about cybersecurity and the cloud from industry leaders?</strong> Check out Cyber Security & Cloud Expo taking place in Amsterdam, California, and London. The comprehensive event is co-located with other leading events including Digital Transformation Week, IoT Tech Expo, Blockchain Expo, and AI & Big Data Expo.</p>
<p><em>Explore other upcoming enterprise technology events and webinars powered by TechForge </em><em>here</em><em>.</em></p>
<p class="tags"><span class="tags-title">Tags:</span> cybersecurity, development, hacking, html, JavaScript, security, web</p>
<p> </p></iframe></div>
<p> </p>
