{"id":13180,"date":"2025-01-31T08:39:46","date_gmt":"2025-01-31T16:39:46","guid":{"rendered":"https:\/\/legacy.gosecure.ai\/?p=13180"},"modified":"2025-02-27T10:58:21","modified_gmt":"2025-02-27T18:58:21","slug":"threat-hunt-of-the-month-browser-session-hijacking-via-malvertising","status":"publish","type":"post","link":"https:\/\/legacy.gosecure.ai\/fr\/blog\/2025\/01\/31\/threat-hunt-of-the-month-browser-session-hijacking-via-malvertising\/","title":{"rendered":"Threat Hunt of the Month: Browser Session Hijacking via Malvertising"},"content":{"rendered":"

[et_pb_section admin_label=\u00a0\u00bbsection\u00a0\u00bb]
\n\t\t\t[et_pb_row admin_label=\u00a0\u00bbrow\u00a0\u00bb]
\n\t\t\t\t[et_pb_column type=\u00a0\u00bb4_4″][et_pb_text admin_label=\u00a0\u00bbText\u00a0\u00bb]\"JanuaryIn January 2025, GoSecure Threat Hunters identified a new browser hijacking campaign leveraging malware dubbed <\/span>MEDIAARENA<\/span><\/b>, which is being actively distributed via malvertising. This Windows-based malware uses valid code-signing certificates, time-based defense evasion, and persistence techniques to manipulate browser settings and steal sensitive session data. Once installed, it establishes persistence through scheduled tasks and exploits Chromium\u2019s remote debugging feature to hijack an infected device\u2019s browser, ultimately modifying search engine settings and redirecting user searches to attacker-controlled domains.<\/span>\u00a0<\/span><\/p>\n

Why This Matters<\/span><\/b>\u00a0<\/span><\/p>\n

Unlike traditional malware that aims to steal credentials or deploy ransomware, <\/span>MEDIAARENA<\/span><\/b> silently alters browser behavior, making detection difficult while maintaining persistent access to user activity. By using hidden browser windows and remote debugging techniques, attackers gain unauthorized access to browser cookies and search engine settings, allowing them to manipulate user traffic, conduct targeted phishing, and collect sensitive browsing data. The covert nature of this attack highlights the increasing sophistication of browser hijacking techniques.<\/span>\u00a0<\/span><\/p>\n

Detection and Monitoring<\/span><\/b>\u00a0<\/span><\/p>\n

GoSecure\u2019s Threat Hunters hypothesized that adversaries were leveraging Chromium\u2019s remote debugging functionality to access browser cookies and manipulate search behavior. After confirming adversary presence, GoSecure developed a high-severity detection rule to flag suspicious browser activity:<\/span>\u00a0<\/span><\/p>\n