IcePick-3PC Malware Strain Steals Device IPs

guest · Jan 9, 2019

IcePick-3PC Malware Strain Steals Device IPs
January 9, 2019
https://www.infosecurity-magazine.com/news/icepick3pc-malware-strain-steals/

IcePick-3PC has impacted a range of businesses, from publishers to e-commerce, across a variety of industries, including retail and healthcare, according to researchers from The Media Trust’s digital security and operations (DSO) team. The malware strain was first identified in spring 2018 and is able to steal device IPs en masse.

When it was initially detected, IcePick-3PC was used to spam device owners using phishing in a campaign that fraudulently offered gift cards from big-name retailers, such as Amazon and Walmart, in return for users sharing their personal information.

In a January 9, 2019, blog post, researchers explained that a website’s third-party tools are designed to incorporate interactive web content, such as animation via HTML5, and are loaded onto client platforms by self-service agencies.
In the attack, which has affected more than 100 clients, IcePick-3PC executes after malware writers successfully hijack a website’s third-party tools.
Click to expand...

guest · Feb 6, 2020

Weather.com Has Become the Pawn of A Huge Data Theft Scheme
IcePick-3PC/eGobbler malware discovered on weather.com is harvesting user IP addresses
February 4, 2020
https://medium.com/bugbountywriteup...pawn-of-a-huge-data-theft-scheme-2af32c56a3ad

Wanna know tomorrow’s temperature? Don’t visit weather.com to find out, especially if you’re on a mobile device: the website has been compromised by a malicious advertising (malvertising) attack that is scraping personal information from its mobile users.

While its purposes are not yet known, security searchers who have already identified and named this strain of malware — alternatively called “IcePick-3PC” or “eGobbler” — theorize that it originates from a group of organized criminals who are collecting the information for a future attack, or selling it on the Dark Web.

But recently, IcePick-3PC changed tactics. Now — to quote Binary Defense: [...]
Here’s the scary part: researchers also believe that this malware is being used by an organized crime ring either to prepare for an enormous future attack on targeted users, or to sell collected information on the dark web. So anyone who has visited weather.com from a mobile device in the past few months is now vulnerable to future malicious activity down the road.
Click to expand...

Analysis
I really didn’t expect to find something this awful on an Alexa 500 site like Weather.com, which — based on public stats from similarweb.com — got about 102.6 million visits a month on average, over the past six months. [...] it’s been displayed to at least 53,560 visitors in the last month.

On the one hand, it’s completely understandable that websites — who depend on third-party advertising to make revenue — fall victim to new malvertising attacks.
On the other hand, the fact that this malware has been known about for some time [...] Either Weather.com hasn’t done anything to protect its users, or its paid someone who has no idea what they’re doing.
Click to expand...

Log in or Sign up

IcePick-3PC Malware Strain Steals Device IPs

guest Guest

guest Guest

Log in or Sign up

IcePick-3PC Malware Strain Steals Device IPs

guest Guest

guest Guest

Useful Searches