JSFire Truck: Exploring Malicious Java Script Using JSF*ck as an Obfuscation Technique
Summary: Unit 42 detected 269,552 webpages infected with injected JavaScript using the JSFireTruck obfuscation technique across the three months from March 26, 2025, through April 25, 2025, with detections rising notably from April 12. The technique, a branch of 2009's JJEncode reduced to six ASCII characters - [ ] ( ) ! + - relies on JavaScript type coercion to generate any code, and the injected scripts check document.referrer for search-engine referrals before inserting a full-window iframe (z-index 30000) that redirects victims to malicious content.
What you should know: Nearly 270,000 legitimate sites were turned into redirectors in a single quarter, and the payload only fires for visitors arriving from search engines - so your own site can be weaponized against your customers without any visible change to the page they land on.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026