Detecting Silly Javascript Obfuscation Techniques

Summary: Cisco Talos analyzed obfuscated JavaScript hosted at bizoplata.ru/pay.html that used repeated String.fromCharCode() calls to hide a chain of 1x1 pixel iframes and HTTP 302 redirects, ending at an exploit for the Microsoft Access Snapshot Viewer ActiveX vulnerability in CVE-2008-2463. When the author revisited the site, the payload had changed to an eval(unescape()) obfuscation style delivering the older ADODB.Stream ActiveX vulnerability from MS04-025.
Why it matters: The existing Snort rules for CVE-2008-2463, SIDs 13903-13910, were useless against this obfuscation because an IDS would need a built-in JavaScript interpreter to dig through multiple code layers at wire speeds, so Talos instead added SID 15362 to detect the obfuscation technique itself.

Read the original at Cisco Talos ↗

Topics: Malware
Mentions: CVE-2008-2463
Related: ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026
Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026
Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026