JavaScript attack aimed to reroute bitcoin transactions

A newly identified JavaScript vulnerability in StatCounter, a popular web analytics platform, allowed hackers to attempt to re-route bitcoin transfers associated with a specific cryptocurrency exchange.

A newly identified JavaScript vulnerability in StatCounter, a popular web analytics platform, allowed hackers to attempt to re-route bitcoin transfers associated with a specific cryptocurrency exchange.

Attackers were able to inject a piece of their own code into JavaScript associated with StatCounter’s system, according to research from ESET. The malicious code searches for URLs that contain “myaccount/withdraw/BTC,” with the intention of replacing the destination address of transfers with an address belonging to the attackers, ESET reports.

The attack target appears to be cryptocurrency trading site Gate.io, the report says, given that it is the only one that uses the “myaccount/withdraw/BTC” Uniform Resource Identifier (URI).

“The users’ funds are safe,” Gate.io said, but it urged customers to maximize the security levels on their accounts.

ESET said it notified the company as soon as it discovered the hack, which it labeled as a “supply chain” attack, given where the malicious code appeared. The company said Wednesday that it has stopped using StatCounter’s services and removed the malicious script.

The malicious code is actually added to the middle of StatCounter’s JavaScript, which makes it harder to detect via casual observation, the report says. Webmasters put the JavaScript into pages so StatCounter’s platform can collect statistics about traffic and users.

Most of the malicious bitcoin transactions were undetected initially by users, ESET says, because the redirection in addresses only occurs after the transfer is submitted.

Gate.io handles several million dollars in transactions daily, according to coinmarketcap.com.

ESET notes that the attacker’s domain had already been suspended in 2010 for abuse.

StatCounter is used by more than 2 million websites and generates stats on more than 10 billion page views per month, according to StatCounter’s website.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure