Summary: Legitimate-but-compromised websites are being used to deliver a Windows backdoor called BadSpace through fake browser updates.
Threat Actor: BadSpace | BadSpace
Victim: Users who visit compromised websites | compromised websites
Key Point :
- The BadSpace threat actor uses a multi-stage attack chain involving infected websites, a command-and-control server, fake browser updates, and a JScript downloader to deploy a backdoor on victims’ systems.
- The attack starts with compromised websites injecting code that collects information about the user’s device and transmits it to a hard-coded domain.
- The server then overlays the web page with a fake Google Chrome update, tricking users into downloading the BadSpace backdoor.

Legitimate-but-compromised websites are being used as a conduit to deliver a Windows backdoor dubbed BadSpace under the guise of fake browser updates.
“The threat actor employs a multi-stage attack chain involving an infected website, a command-and-control (C2) server, in some cases a fake browser update, and a JScript downloader to deploy a backdoor into the victim’s system,” German cybersecurity company G DATA said in a report.
Details of the malware were first shared by researchers kevross33 and Gi7w0rm last month.
It all starts with a compromised website, including those built on WordPress, to inject code that incorporates logic to determine if a user has visited the site before.
Should it be the user’s first visit, the code collects information about the device, IP address, user-agent, and location, and transmits it to a hard-coded domain via an HTTP GET request.

The response from the server subsequently overlays the contents of the web page with a phony Google Chrome update pop-up window to either directly drop the malware or a JavaScript downloader that, in turn, downloads and executes BadSpace.
An analysis of the C2 servers used in the campaign has uncovered connections to a known malware called SocGholish (aka FakeUpdates), a JavaScript-based downloader malware that’s propagated via the same mechanism.
BadSpace, in addition to employing anti-sandbox checks and setting up persistence using scheduled tasks, is capable of harvesting system information and processing commands that allow it to take screenshots, execute instructions using cmd.exe, read and write files, and delete the scheduled task.
The disclosure comes as both eSentire and Sucuri have warned different campaigns leveraging bogus browser update lures in compromised sites to distribute information stealers and remote access trojans.
Source: https://thehackernews.com/2024/06/hackers-exploit-legitimate-websites-to.html
“An interesting youtube video that may be related to the article above”