Operation Poisoned News – Hackers Deliver Malware Targeting iOS Users Using Local News Links

A new campaign dubbed Operation Poisoned News that uses news local news sites links to deploy malware called lightSpy on the user’s iOS devices.

Attackers posted the news articles in various forums, by clicking on the link it takes users to the news sites, but they also have hidden iframe that loads malicious code.

The malicious code is capable of exploiting vulnerabilities present in iOS 12.1 and 12.2, clicking on those links leads to the installation of malware lightSpy on the iOS devices.

Poisoned News Campaign

The lightSpy is the backdoor module that allows attackers to execute the code remotely and to manipulate files in the affected device.

Security researchers from Trend Micro observed the watering hole attack targeting iOS users. The links posted by the attackers include three iframes.

The only visible link is the original news website, with the other two invisible links, one used for analytics purposes and another site hosting exploits.

Here you can find the three iframe

iframes

The attack particularly targets Hong Kong residents, attackers posted links on various popular forums to infect more victims.

To trick the user’s attackers posted the links under the topics such as sex-related, clickbait-type headlines, or news related to the COVID-19 disease.

Researchers also observed another attack type in which the attackers copied the legitimate site and injected with a malicious iframe.

Second method

The malware modules for exfiltrating data infecting device, that includes;

• Connected WiFi history
• Contacts
• GPS location
• Hardware information
• iOS keychain
• Phone call history
• Safari and Chrome browser history
• SMS messages
• Available WiFi network
• Local network IP addresses
• Telegram
• QQ
• WeChat

Exploiting iOS 12.1 and 12.2

The exploit used in the attack affects iOS 12.1 and 12.2, it attacks a variety of iphone models from the iPhone 6S up to the iPhone X.

Versions

“The full exploit chain involves a silently patched Safari bug (which works on multiple recent iOS versions) and a customized kernel exploit,” researchers told.

Once the attacker gained access to the device they install sophisticated spyware to maintain control over the device. The spyware modules designed specifically to exfiltrate the data.

Here are the complete attack chain and modules used

Attack Chain

Researchers also noted an Android counterpart to lightSpy which is called as dmsSpy, the variant was distributed in Telegram channels as apps in 2019.

The dmsSpy malware also includes various functions like traditional malware. It steals more sensitive information such as contacts, text messages, the user’s location, and the names of stored files.

Researchers have notified the vulnerabilities to Apple via Trend Micro’s Zero Day Initiative (ZDI) and to Telegram also, but no response received.