How Adult Websites Are Hiding Exploit Code in Racy SVG Files: What You Need to Know

Recent findings have revealed a concerning trend involving .svg files on certain websites. Researchers from Malwarebytes discovered that malicious code can be hidden in these files, enabling harmful JavaScript to run in browsers.

When activated, this script prompts the browser to download further obfuscated code. Eventually, it delivers a known threat called Trojan.JS.Likejack, which automatically clicks the ‘Like’ button on a Facebook post without the user’s permission. Pieter Arntz, a Malwarebytes researcher, highlighted that this attack requires users to be logged into Facebook, which many people do for convenience.

This isn’t the first time .svg files have been exploited. In 2023, a group of Russian hackers utilized .svg tags to exploit vulnerabilities in Roundcube, impacting over 1,000 webmail services. Moreover, in June this year, researchers uncovered a phishing campaign where attackers used .svg files to present users with fake Microsoft login screens tailored with their email addresses already filled in.

Arntz pointed out that numerous adult-themed sites, primarily powered by WordPress, are leveraging this trick to manipulate Facebook likes. Despite Facebook’s efforts to close accounts involved in such schemes, offenders continue to return with new profiles.

As online threats evolve, this highlights the importance of staying vigilant. Users must be cautious when clicking on suspicious links and files, especially from less reputable sources. Experts recommend regularly updating security software to better defend against these types of attacks. Awareness and caution can go a long way in preventing unwanted intrusions into our digital lives.

Source link