Amy Ciminnisi 0:00

Welcome to the Talos Takes Podcast, where we discuss Talos' latest research and security news. This podcast is for everyone, from the C suite to the front line.

Amy Ciminnisi 0:13

We've all heard about the ClickFix social engineering scheme where users are tricked into running malicious commands on their machines so that actors can gain their initial access. But the threat actors behind a new scheme have moved the playing field entirely. Instead of targeting the operating system, they're going straight for the browser session. They're using a mix of social engineering and some really creative abuse of the Google Visualization API to turn a user's own browser against them. So to help us understand exactly how this works, why it could be so hard to catch in the future, and what security practitioners need to do to stay ahead of it, I am joined today by security engineer Sean Gallagher, who has been leading the research on this campaign. Sean, thanks for being here.

Sean Gallagher 1:07

Good to be here.

Amy Ciminnisi 1:08

Yeah, so let's jump right in. So you've been tracking this campaign for several months now. Can you start by explaining how this ClickFix variation differs from the traditional malware delivery that most people are used to and why this focus has shifted?

Sean Gallagher 1:26

Sure. So uh this is particularly targeting people who are using crypto trading websites. So uh because of the targeting and because of the particular type of crime this is oriented around, uh, the browser is the target since most of the trading is happening through what we would call swap sites, right? They're basically aggregators of different uh distributed uh DeFi type applications and DeFi APIs. So in this case, this differs from your normal ClickFix in that the attacker is not trying to install software onto your computer. They are trying to inject JavaScript into the page that you have loaded when that page is associated with one of these trading sites. So instead of getting you to paste a command line into the Windows run box, they are trying to get you to essentially load JavaScript into a browser session. Initially, they tried to do this by getting people to use the Chrome navigation bar and basically drop JavaScript right into their session. Uh they've moved since to using a plugin that allows you to inject code into a website. So the uh in this case, it's a plugin called TamperMonkey, which has legitimate uses for many people, but in this case, it's being used essentially as a stepping stone to dropping malicious JavaScript into these trading websites. And uh like with other ClickFix type campaigns, there's a bit of a social engineering thing going on here. They need to convince the targeted person that they need to drop this code in. The approach you're taking is a lot different than the usual ClickFix attack, which essentially is saying we're doing a uh we're doing a uh Cloudflare check of your identity, or we're doing a captcha on you to see if you can identify yourself as human and there's a problem with your computer, you need to run this command, right? So um in this case, they're using this very elaborate social engineering campaign where they're trying to convince people that this is a security hole that they have discovered in these sites, and you can exploit it to make more money off of crypto trades by following these instructions.

Amy Ciminnisi 3:55

So they're targeting like novice cyber criminals who might not have understood exactly how everything works.

Sean Gallagher 4:05

They're targeting people who are greedy, right? They're targeting people who are are willing to commit essentially uh essentially commit cybercrime by uh exploiting a fictional vulnerability in these websites to gain additional trading gapability to get a bigger bonus back from their transaction than they normally would. So um they're targeting people in sort of novice cryptocurrency forums, in hacker forums, other dark web forums. Um, for a while they were posting these lures on places like paste bin type sites in comments around other security-related things that people who are sort of beginner cyber criminals or people who are security conscious might be hanging out in and see these comments and then go look at this document. Um, and that gets them into the whole pipeline for this uh this campaign. There's also a supporting telegram feed that continues to point to the lure for this. That is again another place where you know a lot of people who hang out in various dark web places tend to do their communications, and uh they're a lot of the lures that I've seen in some of the dark web forums point back to this telegram channel and say, This is the original source of this hack. You should go here to find the link to get to it, things like that. So um it's really targeting junior cyber criminals.

Amy Ciminnisi 5:42

I mean, we all have to start somewhere.

Sean Gallagher 5:44

Right, right. Oh my god But it's really a very, it's a very elaborate uh lure. And you know, I have a feeling that maybe some AI may have been used in sort of like writing up in the form take my words and put them in the format of a of a uh a vulnerability report.

Amy Ciminnisi 6:00

Um yeah.

Sean Gallagher 6:01

So it's it's it's it's very well-written lure. It's published in a Google Doc. And so uh it's out there and it's this this this campaign uh prior to the one we looked into was active last year, around this time, uh and was using a different method of getting people to inject this code into their system. Um so it's been going on for some time. There have been a couple of sort of knockoff campaigns as well. I think people have copied, copied the idea. Maybe they fell for it the first time and they said, I could use this myself and have spread it around. So um it's an interesting scam operation in terms of its targeting. Uh we don't have a really good feel for how much money people have made off of this, but um considering how little it costs them to operate the infrastructure for this, and we can get into that a little bit, um, it's it's really, you know, it's it's extra money for these people. They're they're doing this in a, I mean, this is something that um honestly, I think somebody who's like a computer science undergrad who's doing or somebody who's doing web page design type stuff and is familiar with doing interactive JavaScript could write up write up in a day and probably get a little bit of AI help to do it. And um once they have the JavaScript written, uh the uses a bunch of fairly fairly common commodity obfuscation tools and things like that. It's just this particular trick they're using to get into the browser is what's really, really interesting about this because it's something that we haven't seen other than in like a state actor situation in the past.

Amy Ciminnisi 7:48

Wow. Simple but lucrative.

Sean Gallagher 7:51

Yes.

Amy Ciminnisi 7:52

Oh my gosh. Um, so yeah, let's let's get into a little bit of the more technical aspects of this. So um one of the interesting aspects of this campaign is the use of uh the Google visualization API for command and control. Um why is this specific API so effective in this campaign for threat actors?

Sean Gallagher 8:18

So, first of all, the Google Visualization API was for it was originally developed by Google Charts. Um it is a read-only API, it requires no security authentication, so there's no uh there's no sign-in, there's no key required. Um so it allows uh JSON to be produced from a Google Sheets spreadsheet. So you can store data in a spreadsheet, and this API makes SQL-like requests against the spreadsheet and returns a JSON file, a JSON document with the content of that query, which can then be parsed by JavaScript in a web application or by any other application that can read JSON, right? So you can it just long if you've got a JSON parser, it can be read by a Python script, it can be read by a lot, a lot of things, right? And and if you have if you just have to code it to read it and uh so the contents can keep get used. Originally they were used to like populate a chart, right? This is right, this is the uh the item that we're ch charting, this is the value, right? Um but in this case, it's being used to deliver a container with malicious JavaScript in it, a loader that will install the malicious JavaScript into a page, inject it into a page. And so that's being called by a script that the user puts in. Originally, this was something they were they were pointing to oft on a paste page. Now the actual script that they're putting in themselves is actually in another Google document. Uh, they've because, well, we've been harassing them for so long at this point, they got they moved off the paste page because I've been talking with a guy who runs a paste page and he set up a cron job that just looked for a new ones being posted and and and marked them as abuse. So now they've moved to using Google Docs to publish the script. That gets put into a, in as I said before, a uh a Tamper Monkey plugin. All right, so it's a script that gets put into Tamper Monkey. Tamper Monkey is a plugin that looks for when you go to a web page and says, okay, this web page, I have instructions to run this script when this per when the user visits this script page. And it's usually to do things like change interfaces to like, you know, like if you wanted to get rid of a bunch of stuff in Facebook when you visited Facebook, you know, if you you've used the uh there's a couple of plugins that are available uh for Facebook to eliminate things in the uh in the CSS and things like or change things in the CSS or change display or hide things, um, you'd use something like TamperMonkey to change the UI. In this case, they're using TamperMonkey to change the UI to add a button that does transaction skimming that actually grabs crypto addresses out of the stream. So with uh the the Google AP Google Visualization API API, uh the benefit is that you have a you know it's it's a public point, it's run from a spreadsheet. The URL is associated with a Google Sheets spreadsheet. So it looks like legitimate network traffic for most systems, right? So it's saying, oh no, it's going to go it's going to Google Gabak. That's a normal behavior, right? It then injects this JavaScript, which gets deobfuscated by the code that's in the script uh to change the destination for any Bitcoin transaction. And it pulls from a randomized list of 30 different addresses, essentially. We saw 30 different addresses being used in the attack. There were others that were in the code that have never been used that we can see. It might just be a bug in the code that's not doing it as randomly as they want it to. In any case, that's all sitting in the spreadsheet, which is publicly viewable by anybody, right? The thing is that they've formatted the spreadsheet so that the text in those fields is white on white, right? So if you're casually viewing the spreadsheet, it doesn't look like there's anything there. There's just something that says API at the top and a bunch of other stuff. So if you if you were like trying to figure out what's going on where this traffic was going to, you'd go to the spreadsheet and there wasn't wouldn't be anything visible to somebody who's just looking at the page trying to analyze it. It's only when you download it and look at the contents without the formatting that you see all this JavaScript. Uh or if you execute the URL that points to it, you get a JSON package. And you can you can deal, you can uh analyze that.

Amy Ciminnisi 12:52

Right. And I imagine you can also probably like hide it even further by putting it way down in the sheet so that like it's not somewhere where people would normally scroll. Exactly.

Sean Gallagher 13:02

And they do that. They do that. In fact, the most recent version of the spreadsheet, the spreadsheet has been there for the entire campaign, except for when we interrupted it the first time in April, right? So they had to they had to switch spreadsheets in April. Um there are artifacts from all of the other versions of the code they've had throughout the campaign through this thing. There's one or two that are up high, but every time they could change, they push something further and further down in the spreadsheet. And so you have to search on the keywords, which is API, right? Search on API to find where the line is that has the code in it. They haven't felt the need to really change the code that much over over the course of this. They've changed it when they've updated not the box, not the addresses that the transactions are going to, but they've used different obfuscation techniques to beat analysis after they've been interrupted. So and there are a number of JavaScript obfuscation tools that are out there that are open source that are easily obtainable on GitHub. These match up with a bunch of those. I looked at the way the output from a bunch of differences, they were very, very close. All they were doing was uh basically using XOR with a key to change the values of text strings. And they were breaking up the text strings as arrays. So they would have an array of content and it would then, in the course of running the code, it would go through the array in a sort of a predetermined fashion and pull the bits of code out of the array and write them to the document object model of the website it's being injected into. And so every time they changed the key, uh they did some slightly different code. We found about roughly 20 different samples. The code that gets injected was almost identical in all of them for this particular campaign we've been watching. Um there was a previous campaign targeting another website that we caught the end of when we started observing this, and that code it's still in the spreadsheet. So my God. Um so they've it's been clear they've they moved targets at one point. They moved from one uh aggregator site to another. Uh when the aggregator site that they were targeting took measures to warn users that there was a problem. And then they we've we have we have informed the site that runs this is being targeted in this particular campaign now of this activity. Um it's not clear that they've done anything to particularly alert customers that this is something that's going on. But um the campaign continues. So uh despite everything we've done with it, it's like they're still going. I still watch their telegram channel and they keep popping up URLs and it's the same one all the time. And we've reported a bunch of it. We reported it several times to Google. So uh, but you know, this there's a limit to how much Google can prevent people from using their architecture, using their platform for this sort of abuse. And right, because when you we did get them taken down before, they were back up again with a new document and a new spreadsheet within a day and a half. So Right.

Amy Ciminnisi 16:13

And I mean, like for most people listening to this, unless you are a budding cyber criminal, um, this specific campaign you probably don't have to worry about, right?

Sean Gallagher 16:26

But this specific campaign, no.

Amy Ciminnisi 16:28

But this one. But this one can be scaled up like on a on a much larger level for like supply chain or enterprise-wide. Absolutely. So like does this keep you up at night at all thinking about it?

Sean Gallagher 16:43

Well, this sort of thing, this sort of thing does like you know, I mean, if you think about uh the types of campaigns we've seen in the past, uh like Magikart, right, where uh people have done injections into uh legitimate web commerce sites by compromising a piece of their software supply chain and essentially adding a card skimmer to their components, right? Those campaigns continue, and usually what is the tip-off on them is that there's this weird web host involved at some point that is the source for some of the code, right? So um they you know, we we can see a URL that's being called that's going to another site and it's it's and it's pulling data or or retrieving data from this transaction. So it's it's doing a little bit of cross-site scripting. But in this case, if they were to say, do this sort of a JavaScript injection, where the injection came from an API, an API called a Google, and a blue team was looking at network trying to block network traffic and just saw a bunch of Google Sheets traffic, right? And you have to be looking for a very specific pattern in in the uh URIs in the web requests because the requests are going to be coming from a browser. That's the other piece, is that normally when we see we look at malware and we see web requests or we see other requests that we are suspicious, they're requests that are coming from applications other than browsers often, right? So we're seeing a PowerShell request, right? And that's what happens with ClickFix. The ClickFix is you like often uses a uh a PowerShell command to make a request from a website. Um, we can spot that, right? Is it why is PowerShell going to this weird URL, right? Yeah. Why is PowerShell going to this to Google, right? Um that's a very unusual request. Um, but if it's coming from a Chrome browser.

Amy Ciminnisi 18:42

I mean, that's that's nothing that would normally be suspicious.

Sean Gallagher 18:46

Right, exactly. So so that's the big concern with this sort of an attack is that someone could, you know, a a a cyber criminal organization that manages to get a to compromise supply chain for a website, or in some other web applic based application. We like what we just saw with like, for example, with team PCP, where Team PCP was able to uh exploit GitHub to inject things into the uh the process of deploying applications, right? Um if if they were able to do that to a web application to any node application, for example, right? Uh no we often see a we we see a lot of node supply chain attacks, right, where people take over a node, uh an NPM account and they change code, right? Um to combine that with this, right, uh, or to do something similar, the requests to Google would be very difficult for a defender to spot based on behavior because it's not those aren't gonna be blacklisted sites. Uh you have to look for the full URI of a request to see that it's a an API request and that it's and and and the formatting of it and catch that pattern. And you have to understand what that pattern is before the request is made. So makes it hard to hunt for, makes it hard to block. So those are things that we have to be concerned about. There are ways to block it, block the set of behavior in your enterprise. You can block attacks against individuals' browsers, right? And we use things like Windows Policy and Google browser management Chrome browser management, right? Locking down the use of additional plugins, limiting the plugins to ones that are approved. But uh, when it's going after other places in the chain, when it happens in the supply chain, it's a much harder problem.

Amy Ciminnisi 20:48

Yeah. I'm thinking for the security practitioners who are listening to this and really concerned about this in their environment in the future potentially. I I guess what what are the most critical defensive steps? Like I know that you said like the Windows policy and everything, but is is is that the main one that you would recommend? You know, what what should people be looking out for?

Sean Gallagher 21:12

Yeah, I would recommend Windows policy and and if you are using Chrome, use having enterprise Chrome management of browsers, right? Um to make sure that you are restricting the ability of users to be led down the bl down the primrose path, so to speak, right? So uh you know, you have to make sure that users aren't self-injecting themselves, right, with with MELP. And obviously fish training is important, right? Because this is a sort of thing that follows the same pattern as ClickFix, right? It goes along with a lot of the other social engineering attacks uh that we look at. Having people be very aware of social engineering is very important. Also, if you have policies about use of uh web applications, is using Google Docs something Something that your organization does normally. If not, maybe do some things at the and consider blocking. Consider blocking at the firewall. I mean, it's not, you know, it's uh, I mean, a lot of people interact with Google Docs as part of their job, even if they aren't authoring them internally, right? Even if they're not something that's going on. A lot of organizations use Google Docs as their platform, right?

Amy Ciminnisi 22:22

Right.

Sean Gallagher 22:22

So you know, you have to you have to make sure that you're taking some consideration of this into your analysis of how you use the platforms and how users access them. From the supply chain side, all the usual things come into play there, right? You have to be it it requires a lot of vigilance about deploying new versions of applications to the web, especially on the public-facing side. Because the biggest threat here is not internal. The biggest threat is customer-facing applications. Uh, if you're doing e-commerce site applications or anything where PII is gathered or things like that, um, and you're using third-party services, you need to make sure that there is an ongoing examination of those services. You're constantly hunting against them, seeing what they're and knowing what their vulnerabilities are, and making sure that you are not offering up opportunities for attackers to do code injection in the middle anywhere. So those are the major considerations I can think of to begin with. And it's going to depend a lot on your organization, depend a lot on your user's application usage, a lot on your on how you present to customers. But it is important to look for this sort of thing because this is, you know, think about how much this costs the attacker.

Amy Ciminnisi 23:40

Very little.

Sean Gallagher 23:41

Very little, right? It's a free platform. Uh it costs them a little bit of time to load it into the environment and to develop and write the write the API calls. It's easily transportable to another infrastructure within the Google Cloud. You know, as we've seen, yeah, in fighting this particular one with a bunch of a bunch of people have been tracking this and and we've all been reporting stuff. It's resilient. It costs only a few minutes of the attacker's time to reload the whole attack into a different set of documents.

Amy Ciminnisi 24:17

I mean, they're and they're going to go through the path of least resistance to getting the most bang for their zero bucks. Exactly. Exactly.

Sean Gallagher 24:28

And so we know that they we know, you know, in in what we've been tracking with this particular scam, I mean, and it's and it's I mean, it's a scam and it's targeting a particular crowd.

Amy Ciminnisi 24:35

Yeah.

Sean Gallagher 24:36

I'm figuring this is probably maybe two or three people doing this, and they've cleared close to $100,000 in the last six months. And that adds up, right?

Amy Ciminnisi 24:47

That's pretty I mean, that's pretty good.

Sean Gallagher 24:50

And they're using some fairly sophisticated crypto uh laundering methods. Or you they're using mixers that I I've yeah, I've been trying to track down some of the way that the currency had been going once it gets out of the wallets that they get sensed to. They're using a couple of mixers, very large transactions uh with lots of uh counterparties to obscure where everything goes. And it's at least and and I've seen it going around and around in circles for a while. I uh I'm working with uh chain analysis to see if we can come up with a better look at where things are going with it once it gets out of the wallets. But it's also, you know, for this sort of thing, the chain analysis tracks its very small potatoes, it's not a big, a big crime spree by the by most measures. This is hardly even like FBI. I don't FBI would look at this and say, why would we get involved? Right?

Amy Ciminnisi 25:41

This is like Yes. Right.

Sean Gallagher 25:43

This is intramurals. So um it's uh it but it's still you know it's been very profitable to these guys. And you can imagine, if done at scale, how much it could turn into.

Amy Ciminnisi 26:00

Thank you so much for coming on and sharing all of this with us. You'll have to, if you haven't already, you should talk to Joe about how they're obscuring everything. He loves the money laundering. Yeah, I'll talk to him of oh yeah.

Sean Gallagher 26:13

No, I talk to Joe all the time, but I will talk with him more about this. Yeah.

Amy Ciminnisi 26:16

Good. Good, good. For our listeners, I will put the blog that he just put out in the show notes. So give that a read. And we'll see you again in two weeks for another episode. Take care and stay safe out there.