Image: Oscar Gutiérrez/CNET
×
chrome-app-ios-logo.jpg
A massive malvertising campaign is exploiting a vulnerability in the Chrome for iOS mobile browser to redirect iPhone and iPad users to adware, scams, and other malicious sites, ZDNet has learned today from Confiant, a cyber-security firm specialized in tracking malvertising campaigns.
The company said it had reported the bug to Google, whose engineers are now investigating the issue.
The bug allows malicious code hidden in online ads to break out of sandboxed iframes (a technology often used to load ad slots) and redirect the user to another site, or show an intrusive popup on top of a legitimate site.
The bug only impacts Chrome for iOS, and no other Chrome version, Eliya Stein, Confiant Senior Security Engineer, told ZDNet today in an email.
Chrome for iOS isn’t a Chromium-based browser but runs on WebKit, which is Safari’s internal browser rendering engine. However, Stein told us that Safari is not impacted either, meaning this is an issue with Google’s Chrome for iOS WebKit implementation only.
eGobbler campaign targets US-based iOS users
According to Stein, this particular malvertising campaign is the work of a known threat actor named eGobbler, first seen during the Thanksgiving holiday last year.
“We have seen eGobbler flare-ups around major holidays,” Stein told ZDNet.
Its last flare-up was in February during the Presidents’ Day holiday weekend, when eGobbler hijacked as many as 800 million ads over a three-day period to redirect users to tech support scams and phishing sites.
In a report published today and shared with ZDNet, Stein said that eGobbler’s latest wave of malicious ads –the ones that abused the Chrome for iOS bug– had around 500 million impressions during which eGobbler attempted to redirect users from legitimate sites to malicious sites.
Most of these malicious ads were seen between April 6 and April 10 and hit iOS users based in the US, which are eGobbler’s typical and historical targets.
Image: Confiant
×
egobbler-april.png
Confiant said it saw eight separate smaller campaigns during which the eGobbler malvertiser placed malicious ads on behalf of 30 fake companies.
With the Easter holiday coming this weekend, Confiant now warns of impending attacks, as advertising companies will have fewer staffers on hand to filter and ban malicious ads from their networks when eGobbler decides to get a new malvertising campaign rolling.
Stein also described eGobbler as one of today’s top three operators of malvertising campaigns, with the other two being VeryMal and ScamClub –both of which had similarly and historically targeted US-based iOS users.
Related malware and cybercrime coverage:
Cybercrime market selling full digital fingerprints of over 60,000 usersThe Bayrob malware gang’s rise and fallReveton ransomware distributor sentenced to six years in prison in the UKScranos rootkit expands operations from China to the rest of the worldEmotet hijacks email conversation threads to insert links to malwareUS government publishes details on North Korea’s HOPLIGHT malware How the United Nations helps fight global cybercrime TechRepublicApple removed popular app that was secretly stealing your browser history CNET
Related Topics:
Apple
Security TV
Data Management
CXO
Data Centers