Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Malicious Java Script Injection Campaign Infects 51k Websites

Summary: Unit 42 researchers detected a malicious JavaScript injection campaign on more than 51,000 hostnames, an estimated 170,000 URLs, active from January 2022 into 2023 and peaking between May and August 2022 at an average of 4,000 daily URLs. The injected code uses obfuscation, benign append attacks into large files such as jQuery, and multistep injections before redirecting victims to adware and scam pages, and in January 2023 Unit 42 blocked an estimated 240,000 sessions across 14,773 devices.

Key Takeaway: Hundreds of the infected sites sat in Tranco's top 1 million, and roughly three quarters of the 51,000 ran a popular CMS, with the malicious code placed on the homepage of more than half - so the compromise reached ordinary visitors, not just the site owners.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related