“The Duri malware, for example, uses the Javascript blob technique.

The attacks are triggered by visiting a website with the malicious code.”

(this could be a well known, sincere, but hacked website)

“By downloading, the malware can install itself on the target device.”

“HTML smuggling is also made possible by the HTML5 “Download” attribute for anchor tags.”

“When a user clicks the HTML link, a download of the file is triggered.”

“The attack therefore uses conventional HTML5 and JavaScript functions.”

“The attack occurs especially in email campaigns.”

“That is, users with Exchange Online mailboxes are also affected.”

“Spear phishing campaign can ransomware”

“This technique was noticed in a spear phishing campaign in May 2021.

“As part of these attacks, the banking Trojan Mekotio as well as AsyncRAT/NJRAT and Trickbot were infiltrated – this also means remote code execution and complete takeover of computers is possible.”

Ransomware also enters networks in this way.”

“The Microsoft 365 Defender Threat Intelligence Team shows what such an attack looks like in a Twitter post.

ISOMorph Infection: In-Depth Analysis of a New HTML Smuggling Campaign

src: translated from https://www.security-insider.de/html-smuggling-greift-netzwerke-von-innen-an-a-1109311/

Links:

https://www.bleepingcomputer.com/news/security/duri-campaign-smuggles-malware-via-html-and-javascript/

JavaScript is evil (= a major security problem)

the EvilNess of JavaScript (DON’T BE EVIL TWITTER) strikes … again!

xiaomi nfc and baseband exploit – Confirmed! JavaScript is indeed EVIL! Also on Phones!

BitCoin zCash Monero Mining via JavaScript inside Browser of Website Visitors

amd arm intel cpus all got problems – Meltdown and Spectre – JavaScript could steal your Firefoxs Passwords

Mail Thunderbird – disable JavaScript

 

admin