Join us at Netskope’s SASE Summit, coming to a city near you! Register now.

  • Security Service Edge Products

    Protect against advanced and cloud-enabled threats and safeguard data across all vectors.

  • Borderless SD-WAN

    Confidently provide secure, high-performance access to every remote user, device, site, and cloud.

  • Platform

    Unrivaled visibility and real-time data and threat protection on the world's largest security private cloud.

The platform of the future is Netskope

Intelligent Security Service Edge (SSE), Cloud Access Security Broker (CASB), Cloud Firewall, Next Generation Secure Web Gateway (SWG), and Private Access for ZTNA built natively into a single solution to help every business on its journey to Secure Access Service Edge (SASE) architecture.

Go to Products Overview
Netskope video
Borderless SD-WAN: Ushering in the New Era of Borderless Enterprise

Netskope Borderless SD-WAN offers an architecture that converges zero trust principles and assured application performance to provide unprecedented secure, high-performance connectivity for every site, cloud, remote user, and IoT device.

Read the article
Borderless SD-WAN
Netskope delivers a modern cloud security stack, with unified capabilities for data and threat protection, plus secure private access.

Explore our platform
Birds eye view metropolitan city
Make the move to market-leading cloud security services with minimal latency and high reliability.

Learn about NewEdge
Lighted highway through mountainside switchbacks
Safely enable the use of generative AI applications with application access control, real-time user coaching, and best-in-class data protection.

Learn how we secure generative AI use
Safely Enable ChatGPT and Generative AI
Zero trust solutions for SSE and SASE deployments

Learn about Zero Trust
Boat driving through open sea
Netskope enables a safe, cloud-smart, and fast journey to adopt cloud services, apps, and public cloud infrastructure.

Learn about Industry Solutions
Wind turbines along cliffside
  • Our Customers

    Netskope serves more than 2,000 customers worldwide including more than 25 of the Fortune 100

  • Customer Solutions

    We are here for you and with you every step of the way, ensuring your success with Netskope.

  • Training and Certification

    Netskope training will help you become a cloud security expert.

We help our customers to be Ready for Anything

See our Customers
Woman smiling with glasses looking out window
Netskope’s talented and experienced Professional Services team provides a prescriptive approach to your successful implementation.

Learn about Professional Services
Netskope Professional Services
Secure your digital transformation journey and make the most of your cloud, web, and private applications with Netskope training.

Learn about Training and Certifications
Group of young professionals working
  • Resources

    Learn more about how Netskope can help you secure your journey to the cloud.

  • Blog

    Learn how Netskope enables security and networking transformation through security service edge (SSE).

  • Events & Workshops

    Stay ahead of the latest security trends and connect with your peers.

  • Security Defined

    Everything you need to know in our cybersecurity encyclopedia.

Security Visionaries Podcast

Bonus Episode 2: The Magic Quadrant for SSE and Getting SASE Right
Mike and Steve discuss the Gartner® Magic Quadrant™ for Security Service Edge (SSE), Netskope’s positioning, and how the current economic climate will impact the SASE journey.

Play the podcast
Bonus Episode 2: The Magic Quadrant for SSE and Getting SASE Right
Latest Blogs

How Netskope can enable the Zero Trust and SASE journey through security service edge (SSE) capabilities.

Read the blog
Sunrise and cloudy sky
Netskope AWS Immersion Day World Tour 2023

Netskope has developed a variety of hands-on labs, workshops, in-depth webinars and demos to educate and assist AWS customers in the usage and deployment of Netskope products.

Learn about AWS Immersion Day
AWS Partner
What is Security Service Edge?

Explore the security side of SASE, the future of network and protection in the cloud.

Learn about Security Service Edge
Four-way roundabout
  • Company

    We help you stay ahead of cloud, data, and network security challenges.

  • Why Netskope

    Cloud transformation and work from anywhere have changed how security needs to work.

  • Leadership

    Our leadership team is fiercely committed to doing everything it takes to make our customers successful.

  • Partners

    We partner with security leaders to help you secure your journey to the cloud.

Supporting sustainability through data security

Netskope is proud to participate in Vision 2045: an initiative aimed to raise awareness on private industry’s role in sustainability.

Find out more
Supporting Sustainability Through Data Security
Highest in Execution. Furthest in Vision.

Netskope recognized as a Leader in the 2023 Gartner® Magic Quadrant™ for Security Service Edge.

Get the report
Netskope recognized as a Leader in the 2023 Gartner® Magic Quadrant™ for Security Service Edge.
Thinkers, builders, dreamers, innovators. Together, we deliver cutting-edge cloud security solutions to help our customers protect their data and people.

Meet our team
Group of hikers scaling a snowy mountain
Netskope’s partner-centric go-to-market strategy enables our partners to maximize their growth and profitability while transforming enterprise security.

Learn about Netskope Partners
Group of diverse young professionals smiling

Black Friday is Coming and LNKR Malware Might Be Watching You

Nov 24 2021


Black Friday is a long-awaited day for many people, as it generates a lot of sales in both physical stores and online marketplaces. With the ongoing COVID pandemic, online sales are expected to be even more intense this year, and along with that, we will likely see an increase in cyber scams.

Attackers will try to steal your money in many ways: through phishing sites, banking malware, remote access trojans, and more. However, there is one type of malware that people often underestimate: adware.

In 2019, Netskope Threat Labs identified a campaign linked to the malware LNKR, which is an Ad Injection Framework commonly delivered through malicious Google Chrome extensions, where the attacker can inject rogue advertisements on any page the victim is accessing for monetization. Later in 2020, we identified another campaign from LNKR, after blocking this variant from many different pages.

The year 2021 is no different either. LNKR is still active and Netskope continues to block requests from this threat. With the upcoming Black Friday holiday, the demand for products increases, as well as the chances of someone landing on a fraudulent page through a malicious advertisement. In this blog post, we will analyze LNKR and show how this type of threat can be dangerous.

LNKR Malware

Although this threat is adware, it’s not as harmless as one may think. LNKR contains many capabilities, including:

  • Exfiltrate data from search engines;
  • Redirect the user to any page the attacker wants;
  • Display its own monetized advertisements;
  • Inject any JavaScript from external websites.

LNKR is commonly distributed via infected Google Chrome extensions. However, the code is also capable of self-replication, injecting itself into web pages where the user has write permissions (i.e. capable of infecting websites).

Screenshot of main LNKR script.
Main LNKR script.

As soon as the script is loaded, it sends several requests to its C2 server, which is hosted on the same website as the main script. In these requests, we can see the following pattern:

  • /metric/
    This endpoint is used as feedback for LNKR actions, whether they were successful or not.
  • /optout/<operation>
    This endpoint is used to interact with the malware’ configuration, where <operation> can be “set” or “get”. The list of actions LNKR performs through this endpoint was mapped by TrendMicro early in 2021.
Screenshot of LNKR initial requests
LNKR initial requests.

The metrics requests are sent through an invisible image element that is added to the HTML page.

Screenshot of LNKR function for sending metrics to the C2 server.
LNKR function for sending metrics to the C2 server.

Analyzing its capabilities, the malware starts by injecting many scripts into the page that are loaded through a hardcoded configuration.

Screenshot of LNKR external scripts to load.
LNKR external scripts to load.

This configuration is stored in JSON, where it has the URLs for the external scripts and other settings such as allowed/denied countries and browsers.

Screenshot of LNKR external scripts to be injected into the page.
LNKR external scripts to be injected into the page.

In this case, one of the external scripts loaded by LNKR contains a function named “insertScript”, which can be used to inject JavaScript code into any page the victim is accessing. 

This is extremely dangerous as the attacker can inject anything into the page, like a script to steal credit card data for example.

Screenshot of Function to inject JavaScript code into the page.
Function to inject JavaScript code into the page.

This malware also contains hardcoded targeted websites, like the Russian social network named OK, where the rogue advertisement is loaded through iframes.

Screenshot of function to inject JavaScript code into the page.
Function to inject JavaScript code into the page.

Another targeted website is Amazon. The malware checks the website the user is browsing through a regex pattern.

Screenshot of LNKR checking if the website is Amazon.
LNKR checking if the website is Amazon.

If the victim is shopping at Amazon, the malware collects information about the products, such as the name, price, and items in the cart, which are later used for advertisement/monetization.

Screenshot of LNKR exfiltrating information from Amazon.
LNKR exfiltrating information from Amazon.

Booking is also on the target list. If the victim accesses the original website or its corresponding typos, the request is stopped and the user is redirected to another page.

Screenshot of LNKR redirects the user if the page is Booking.
LNKR redirects the user if the page is Booking.

Furthermore, there are also functions to exfiltrate data from search engines, like Google, Yahoo, and If that’s the case, anything the victim is searching is redirected to another page.

Screemshot of LNKR redirects the victim’s search.
LNKR redirects the victim’s search.


We demonstrated how LNKR is able to inject JavaScript into any page, redirect and exfiltrate the victim’s search results, and display rogue advertisements for its own benefit. Adware is not as harmless as one might think, as it can cause many serious problems such as theft of personal information, and delivery of other types of malware. We need to be on the lookout for these types of attacks, especially during Black Friday, where the chance of accessing a fraudulent ad is increased.


Netskope Threat Labs is actively monitoring this campaign and has ensured coverage for all known threat indicators and payloads. 

  • Netskope Threat Protection
    • Script-JS.Adware.Lnkr
  • Netskope Advanced Threat Protection provides proactive coverage against this threat.
    • Gen.Malware.Detect.By.StHeur indicates a sample that was detected using static analysis
    • Gen.Malware.Detect.By.Sandbox indicates a sample that was detected by our cloud sandbox


Hashes (SHA256)













Other IOCs for LNKR can be found here and here.

author image
Gustavo Palazolo
Gustavo Palazolo is an expert in malware analysis, reverse engineering and security research, working many years in projects related to electronic fraud protection. He is currently working on the Netskope Research Team, discovering and analyzing new malware threats.