- Attackers use real Google URLs to sneak malware past antivirus and into your browser undetected
- This malware only activates during checkout, making it a silent threat to online payments
- The script opens a WebSocket connection for live control, completely invisible to the average user
A new browser-based malware campaign has surfaced, demonstrating how attackers are now exploiting trusted domains like Google.com to bypass traditional antivirus defenses.
A report from security researchers at c/side, this method is subtle, conditionally triggered, and difficult for both users and conventional security software to detect.
It appears to originate from a legitimate OAuth-related URL, but covertly executes a malicious payload with full access to the user’s browser session.
You may like
- Google Apps Script abused to launch dangerous phishing attacks
- Criminals hijacking subdomains of popular websites such as Bose or Panasonic to infect victims with malware: here’s how to stay safe
- Cybercriminals have found a sneaky way of stealing tax accounts and even encrypted messages: here’s what you need to know
Malware hidden in plain sight
The attack begins with a script embedded in a compromised Magento-based ecommerce site which references a seemingly harmless Google OAuth logout URL: https://accounts.google.com/o/oauth2/revoke.
However, this URL includes a manipulated callback parameter, which decodes and runs an obfuscated JavaScript payload using eval(atob(…)).
The use of Google’s domain is central to the deception – because the script loads from a trusted source, most content security policies (CSPs) and DNS filters allow it through without question.
This script only activates under specific conditions. If the browser appears automated or the URL includes the word “checkout,” it silently opens a WebSocket connection to a malicious server. This means it can tailor malicious behavior to user actions.
