Watering Hole Attacks Push ScanBox Keylogger
BLUF
Threat actor TA423 is leveraging watering hole attacks to deploy the ScanBox keylogger against targeted web visitors.
NEWS
Security researchers identified a campaign where APT TA423 compromised legitimate websites to deliver the ScanBox JavaScript tool. This reconnaissance tool captures keystrokes and system information from users who visit the infected pages without requiring additional user interaction.
Why I Care
Watering hole attacks bypass traditional perimeter defenses by targeting trusted sites, putting any visitor at risk of credential theft and surveillance. Organizations in targeted sectors face increased espionage risks as attackers harvest data silently through browser-based exploits.
Next Steps
Security teams should immediately review web traffic logs for anomalies and ensure content security policies block unauthorized JavaScript execution. Administrators must patch vulnerable web servers to prevent compromise and educate users on recognizing suspicious site behavior by the end of the week.
Source: Threatpost ·