The Power of Open Source Intelligence
Summary: A Sourcefire customer submitted a heavily obfuscated JavaScript sample that redirected to a BlackHole exploit kit, and Cisco Talos wrote experimental rules around mixed ASCII and hexadecimal escapes in setTimeout() and addEventListener() calls. After testing produced false positives from sites like Google but also caught malicious pages, Talos added SIDs 23841 and 23842 to its INDICATOR-OBFUSCATION category, off by default, and created the ClamAV signature JS.Obfus-218 for two samples that zero of 42 and then two of 42 antivirus vendors detected.
What you should know: The first sample was caught by none of 42 antivirus vendors and the second by only two, so detection here depended on one customer volunteering to test rules on his own network and report back.
Read the original at Cisco Talos ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026