Back 
Summary
Black Friday is a long-awaited day for many people, as it generates a lot of sales in both physical stores and online marketplaces. With the ongoing COVID pandemic, online sales are expected to be even more intense this year, and along with that, we will likely see an increase in cyber scams.
Attackers will try to steal your money in many ways: through phishing sites, banking malware, remote access trojans, and more. However, there is one type of malware that people often underestimate: adware.
In 2019, Netskope Threat Labs identified a campaign linked to the malware LNKR, which is an Ad Injection Framework commonly delivered through malicious Google Chrome extensions, where the attacker can inject rogue advertisements on any page the victim is accessing for monetization. Later in 2020, we identified another campaign from LNKR, after blocking this variant from many different pages.
The year 2021 is no different either. LNKR is still active and Netskope continues to block requests from this threat. With the upcoming Black Friday holiday, the demand for products increases, as well as the chances of someone landing on a fraudulent page through a malicious advertisement. In this blog post, we will analyze LNKR and show how this type of threat can be dangerous.
LNKR Malware
Although this threat is adware, it’s not as harmless as one may think. LNKR contains many capabilities, including:
- Exfiltrate data from search engines;
- Redirect the user to any page the attacker wants;
- Display its own monetized advertisements;
- Inject any JavaScript from external websites.
LNKR is commonly distributed via infected Google Chrome extensions. However, the code is also capable of self-replication, injecting itself into web pages where the user has write permissions (i.e. capable of infecting websites).
As soon as the script is loaded, it sends several requests to its C2 server, which is hosted on the same website as the main script. In these requests, we can see the following pattern:
- /metric/
This endpoint is used as feedback for LNKR actions, whether they were successful or not. - /optout/<operation>
This endpoint is used to interact with the malware’ configuration, where <operation> can be “set” or “get”. The list of actions LNKR performs through this endpoint was mapped by TrendMicro early in 2021.