Why Is an Australian Footballer Collecting My Passwords? The Various Ways Malicious Java Script Can Steal Your Secrets
Summary: Unit 42 researchers documented malicious JavaScript samples that steal passwords and credit card data by abusing legitimate cloud APIs, including chatbot, survey, and chat platform REST endpoints, with one chatbot registered to someone claiming to be an Australian footballer. Palo Alto Networks' Advanced URL Filtering service detected over 216,000 distinct exfiltration attacks in one three-month period, and the researchers found that 33% of exfiltration collection points were shared across more than one domain and 56% across more than one URL.
What's compelling: Attackers are hiding credential theft inside trusted cloud API domains to borrow their reputation and avoid firewall blocking, and some samples refuse to detonate when they detect a security crawler or debugging artifacts, so many vendors' static and dynamic tools never see the payload at all.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026