Facebook Malware: Tag Me If You Can
summary
Kaspersky and Undot reverse engineer a multi‑stage campaign that uses a JSE dropper to install an AutoIt-backed payload which sideloads a tiny Chrome extension and achieves a browser man-in-the-middle to capture tokens and traffic. The campaign uploads payloads to victims’ Google Drive, opens files via 10,000+ infections in a 24‑hour spike, and weaponizes the Facebook comments plugin to bypass redirect warnings — a real Facebook notifications exploit that lets attackers tag users and auto‑download malware.
AI-written summary · about
chapters (16)
- 0:00Start
- 6:30WINDOWS DESIGNATED
- 9:48BACKGROUND CHECK
- 11:27INITIAL INFECTION
- 13:41DYNAMIC ANALYSIS
- 16:37CHROME EXTENSION AS A MITM
- 19:16THE MISSING PIECE
- 19:43OBFUSCATED DROPPER
- 21:56DEOBFUSCATION
- 22:56ANTI-ANALYSIS
- 25:30INITIATING THE CODE CRASH
- 28:41VICTIM INFO STEALER
- 34:47CREATING MALICIOUS CALLERS
- 36:39HOW TO FAIL SAFE
- 38:59VULNERABILITY IN THE WILD
- 42:34QUESTIONS?
related talks
54mModern Malvertising and Malware web-based exploit campaigns
42mThe Ways Hackers Are Taking To Win The Mobile Malware Battle
56mCybersecurity & Privacy From The Global Lens
44mBeyond Desktops: The Rise and Transformation of Mobile Malware
27mCatching the Phisherman
30mReversing Mobile Malware
49mThe State Of Malware From The Eye Of The Tiger
34mWajam: From a Start-up to Massive Spread Adware