{"id":23263,"date":"2023-10-30T16:13:00","date_gmt":"2023-10-31T00:13:00","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2023\/10\/30\/news-16993\/"},"modified":"2023-10-30T16:13:00","modified_gmt":"2023-10-31T00:13:00","slug":"news-16993","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2023\/10\/30\/news-16993\/","title":{"rendered":"Hong Kong residents targeted in malvertising campaigns for WhatsApp, Telegram"},"content":{"rendered":"\n<p>Malvertising is a powerful malware or scam delivery mechanism that makes it easy to target specific geographies or even users. A recent&nbsp;<a href=\"https:\/\/www.scmp.com\/news\/hong-kong\/law-and-crime\/article\/3238722\/scam-websites-disguised-whatsapp-login-pages-top-google-search-results-hong-kong-despite-efforts\" target=\"_blank\" rel=\"noreferrer noopener\">article<\/a>&nbsp;from the South China Morning Post discussed an increase in malicious webpages for the popular WhatsApp communication tool, driven via malicious Google ads. The paper described how these ads appeared to be exclusively targeted at people from Hong Kong and have caused losses of about USD$300K last month.<\/p>\n<p>We started investigating this situation and were able to identify what may be&nbsp;a similar campaign. The decoy sites we saw used a similar page than the web version of WhatsApp to trick victims into scanning a QR code to link&nbsp;their new device. Instead, it wasn&#8217;t the user&#8217;s device that was added to the WhatsApp account, but rather the threat actor&#8217;s.<\/p>\n<p>We also found another campaign using an ad for messaging tool Telegram, to lure victims into downloading a malicious version of the program. Again, this attack was targeted at residents of Hong Kong.<\/p>\n<p>We have reported the malicious ads to Google and worked with partners to take down the infrastructure used in these campaigns.<\/p>\n<h2 class=\"wp-block-heading\" id=\"h-malicious-whatsapp-ad-leads-to-qr-code-page\">Malicious WhatsApp ad leads to QR code page<\/h2>\n<p>Just like&nbsp;the South China Morning Post stated that users were seeing malicious ads for WhatsApp, we were able to find one immediately after switching our online profile to use a Hong Kong IP address:<\/p>\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" loading=\"lazy\" width=\"838\" height=\"317\" src=\"https:\/\/www.malwarebytes.com\/wp-content\/uploads\/sites\/2\/2023\/10\/image-30.png\" alt=\"\" class=\"wp-image-94864\" \/><\/figure>\n<p>The text of the ad reads as follows (translated from Chinese):<\/p>\n<p><em>WhatsApp New Version &#8211; WhatsApp Official Authorization<\/em><\/p>\n<p><em>We are constantly updating and launching various fun and interesting functions as well as safe and reliable communication applications. Welcome to download and experience it. The cross-platform application brings you a reliable experience, and you can send private messages to your friends at any time.<\/em><\/p>\n<p>Clicking on the ad leads to a convincing lookalike site in Chinese that pretends to be WhatsApp Web:<\/p>\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" loading=\"lazy\" width=\"1389\" height=\"844\" src=\"https:\/\/www.malwarebytes.com\/wp-content\/uploads\/sites\/2\/2023\/10\/image-29.png?w=1024\" alt=\"\" class=\"wp-image-94863\" \/><\/figure>\n<p>What&#8217;s interesting, and works well as a lure, is the fact that WhatsApp is not just a mobile phone app, but does indeed have a web version for computers as well. The real domain for it is hosted at&nbsp;<a href=\"https:\/\/web.whatsapp.com\/\">web.whatsapp.com<\/a>&nbsp;and also uses a QR code to add a linked device to your account. What this means is that you can use WhatsApp on your PC or Mac after you scan the QR code and authorize that new device&nbsp;from your phone.<\/p>\n<p>The issue here is that the QR code you are scanning is from a malicious site that has nothing to do with WhatsApp:<\/p>\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" loading=\"lazy\" width=\"596\" height=\"363\" src=\"https:\/\/www.malwarebytes.com\/wp-content\/uploads\/sites\/2\/2023\/10\/image-28.png\" alt=\"\" class=\"wp-image-94862\" \/><\/figure>\n<p>The domain used to generate those QR codes (lawrencework[.]com) was registered just two days ago. A&nbsp;<a href=\"https:\/\/urlscan.io\/search\/#domain%3Alawrencework.com\">search<\/a>&nbsp;on urlscan.io reveals that it is associated with several other fake WhatsApp pages. We tested the QR code by&nbsp;adding it from a burner phone with a brand new WhatsApp account without any previous linked devices. A few seconds later, we saw a new device was added (Google Chrome running on Mac OS):<\/p>\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" loading=\"lazy\" width=\"360\" height=\"640\" src=\"https:\/\/www.malwarebytes.com\/wp-content\/uploads\/sites\/2\/2023\/10\/image-27.png\" alt=\"\" class=\"wp-image-94861\" \/><\/figure>\n<p>While we could not get more information (IP address, geolocation) about this new device, we knew it was not ours. When you&nbsp;<a href=\"https:\/\/faq.whatsapp.com\/653480766448040\/?cms_platform=web\" target=\"_blank\" rel=\"noreferrer noopener\">link a new device<\/a>&nbsp;to your WhatsApp account, the saved chat history is synced to it.&nbsp;This means that an attacker&nbsp;can essentially read your entire past and future conversations and has access to your saved contacts.<\/p>\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" loading=\"lazy\" width=\"782\" height=\"325\" src=\"https:\/\/www.malwarebytes.com\/wp-content\/uploads\/sites\/2\/2023\/10\/image-26.png\" alt=\"\" class=\"wp-image-94860\" \/><\/figure>\n<h2 class=\"wp-block-heading\" id=\"h-telegram-ad-links-to-malware\">Telegram ad links to malware<\/h2>\n<p>The second ad we saw related to this campaign was using Telegram as a lure. We know it is related to the above WhatsApp attack because the ad is from the same advertiser.<\/p>\n<p>The text of the ad reads as follows (translated from Chinese):<\/p>\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" loading=\"lazy\" width=\"746\" height=\"340\" src=\"https:\/\/www.malwarebytes.com\/wp-content\/uploads\/sites\/2\/2023\/10\/image-25.png\" alt=\"\" class=\"wp-image-94859\" \/><\/figure>\n<p><em>telegram official website \u2013 telegram Chinese version \u2013 telegram download Telegram Chinese version is a Telegram client specially developed for Chinese users. Welcome to the Chinese channel, a new era of information, delivering more exciting information<\/em><\/p>\n<p>It links to a Google Docs page pretending to be a download site:<\/p>\n<p><em>Telegram instant messaging &#8211; simple, fast, secure and syncs across all your devices. It is one of the most downloaded apps in the world, with over 500 million active users. The latest official Telegram Chinese computer version TG-Chinese version: Click to download TG-PC: Click to download<\/em><\/p>\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" loading=\"lazy\" width=\"862\" height=\"875\" src=\"https:\/\/www.malwarebytes.com\/wp-content\/uploads\/sites\/2\/2023\/10\/image-24.png\" alt=\"\" class=\"wp-image-94858\" \/><\/figure>\n<p>The\u00a0two links (identical)\u00a0download an MSI installer from the following URL:<\/p>\n<pre class=\"wp-block-code\"><code>kolunite.oss-ap-southeast-7.aliyuncs&#091;.]com\/HIP-THH-19-1.msi<\/code><\/pre>\n<p>This&nbsp;<a href=\"https:\/\/www.virustotal.com\/gui\/file\/36d11b18d3345ff743f7b003d10a0820c8c1661dd7dc279434e436de798c3a4b\" target=\"_blank\" rel=\"noreferrer noopener\">installer<\/a>&nbsp;has been injected with&nbsp;<a href=\"https:\/\/www.virustotal.com\/gui\/file\/0f9a72c8996386eee52e083d798f043a69342954cf0463faa84323d9393193c9\/detection\" target=\"_blank\" rel=\"noreferrer noopener\">malware<\/a>, which we can see once we execute it:<\/p>\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" loading=\"lazy\" width=\"807\" height=\"457\" src=\"https:\/\/www.malwarebytes.com\/wp-content\/uploads\/sites\/2\/2023\/10\/image-23.png\" alt=\"\" class=\"wp-image-94857\" \/><\/figure>\n<h2 class=\"wp-block-heading\" id=\"h-targeted-malvertising-and-motives\">Targeted malvertising and motives<\/h2>\n<p>These two campaigns abusing the WhatsApp and Telegram brands could be used for a variety of reasons. We did not investigate further what the ultimate ploy was, although both lead to data theft, impersonation and malware. The threat actor could use any private information from past conversations, phish the victim&#8217;s contacts and much more.<\/p>\n<p>This was our first foray into malvertising attacks targeted at Hong Kong. Given&nbsp;that this special administrative region of the People&#8217;s Republic of China has a long history&nbsp;of tensions with Beijing, we could not help but think that malvertising campaigns such as these could be used for political reasons, although we&nbsp;saw no evidence of it.<\/p>\n<p>Linking&nbsp;additional devices via QR code is a useful feature but it can also easily be abused. It&#8217;s important to be cautious when scanning QR codes by verifying which site is issuing those. It&#8217;s a good idea to periodically check which devices have access to your accounts, and revoke any that you don&#8217;t recognize.<\/p>\n<p><em>Thanks to Nathan Collier for the assist with the QR code scanning on Android.<\/em><\/p>\n<h2 class=\"wp-block-heading\" id=\"h-indicators-of-compromise\">Indicators of Compromise<\/h2>\n<p>Malicious WhatsApp domain<\/p>\n<pre class=\"wp-block-code\"><code>suaa.vvg2rt&#091;.]top<br>wss.f8ddcc&#091;.]com<\/code><\/pre>\n<p>QR code hostname<\/p>\n<pre class=\"wp-block-code\"><code>119srv&#091;.]lawrencework&#091;.]com<\/code><\/pre>\n<p>Telegram\u00a0MSI URL<\/p>\n<pre class=\"wp-block-code\"><code>kolunite.oss-ap-southeast-7.aliyuncs&#091;.]com\/HIP-THH-19-1.msi<\/code><\/pre>\n<p>Telegram MSI<\/p>\n<pre class=\"wp-block-code\"><code>36d11b18d3345ff743f7b003d10a0820c8c1661dd7dc279434e436de798c3a4b<\/code><\/pre>\n<p><a href=\"https:\/\/www.malwarebytes.com\/blog\/threat-intelligence\/2023\/10\/hong-kong-residents-targeted-in-malvertising-campaigns-for-whatsapp-telegram\" target=\"bwo\" >https:\/\/blog.malwarebytes.com\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p> Malvertising is a powerful malware or scam delivery mechanism that makes it easy to target specific geographies or even users. A&#8230; <\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10488,10378],"tags":[12040],"class_list":["post-23263","post","type-post","status-publish","format-standard","hentry","category-malwarebytes","category-security","tag-threat-intelligence"],"_links":{"self":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/23263","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=23263"}],"version-history":[{"count":0,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/23263\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=23263"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=23263"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=23263"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}