{"uuid": "3c03ca5f-367a-4a71-9bf0-0e5ee4b7007f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30551", "type": "seen", "source": "https://t.me/hacking_Attack/16764", "content": "Black Hat Ethical Hacking\nSafari Zero-Day Used in Malicious LinkedIn Campaign\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Safari Zero-Day Used in Malicious LinkedIn CampaignPost Views: 72 \nReading Time: 1 Minute\nThreat actors used a Safari zero-day flaw to send malicious links to government officials in Western Europe via LinkedIn before researchers from Google discovered and reported the vulnerability.\nThat\u2019s the word from researchers from Google\u00a0Threat Analysis Group (TAG) and Google Project Zero, who Wednesday posted a blog\u00a0shedding more light on several zero-day flaws that they discovered so far this year. Researchers in particular detailed how attackers exploited the vulnerabilities\u2014the prevalence of which are on the rise\u2013before they were addressed by their respective vendors.\n\nTAG researchers discovered the Safari WebKit flaw, tracked as CVE-\u200b2021-1879, on March 19. The vulnerability allowed for the processing of maliciously crafted web content for universal cross site scripting and was addressed by Apple in an update later that month.\n\nBefore the fix, researchers assert Russian-language threat actors were exploiting the vulnerability in the wild by using LinkedIn Messaging to send government officials from Western European countries malicious links that could collect website-authentication cookies, according to the post by Maddie Stone and Clement Lecigne from Google TAG.\n\n\u201cIf the target visited the link from an iOS device, they would be redirected to an attacker-controlled domain that served the next-stage payloads,\u201d they wrote.\n\nThe exploit, which targeted iOS versions 12.4 through 13.7, would turn off Same-Origin-Policy\u00a0protections on an infected device to collect authentication cookies from several popular websites\u2013including Google, Microsoft, LinkedIn, Facebook and Yahoo\u2013and then send them via WebSocket to an attacker-controlled IP, researchers wrote. The victim would need to have a session open on these websites from Safari for cookies to be successfully exfiltrated.\n\nMoreover, the campaign targeting iOS devices coincided with others from the same threat actor\u2014which Microsoft has identified as Nobelium\u2013targeting users on Windows devices to deliver Cobalt Strike, researchers wrote. Security firm Volexity described one of these attacks in a report\u00a0posted online in May, the researchers added.\n\nNobellium is believed to be a Russia-based threat group responsible for the expansive cyber-espionage SolarWinds\u00a0campaign, which affected numerous U.S. government agencies and tech companies, including Microsoft.\nSee Also: Kaseya ransomware supply chain attack: What you need to know Other Zero-Day AttacksGoogle researchers also linked three additional zero-day flaws they identified this year to a commercial surveillance vendor, according to Google TAG\u2019s Shane Huntley. Two of those vulnerabilities\u2013CVE-2021-21166\u00a0and CVE-2021-30551\u2014were found in Chrome, and one, tracked as CVE-2021-33742, in Internet Explorer.\n\nCVE-2021-21166 and CVE-2021-30551, two Chrome rendered remote-code execution (RCE) flaws, were identified separately but later believed to be used by the same actor, researchers wrote in the blog. Google researchers discovered the former in February and the latter in June.\n\n\u201cBoth of these 0-days were delivered as one-time links sent by email to the targets, all of whom we believe were in Armenia,\u201d Stone and Lecigne wrote. \u201cThe links led to attacker-controlled domains that mimicked legitimate websites related to the targeted users.\u201d\n\nWhen prospective victims clicked the link, they were redirected to a webpage that would fingerprint their device, collect system information about the client, and generate ECDH k[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:33.348028Z"}