Ankura CTIX FLASH Update - September 17, 2024

Malware Activity

Malware Locks Browser in Kiosk Mode, Frustrating User into Entering Credentials

A recent malware campaign has been identified that traps users in their browser's kiosk mode on Google's login page, compelling them to enter their Google credentials out of annoyance. The malware locks the browser, disabling the "ESC" and "F11" keys, which prevents users from easily exiting kiosk mode. Kiosk mode is a specialized setting in web browsers or apps that allows them to operate in full-screen mode without standard user interface elements such as toolbars, address bars, or navigation buttons. This mode is intended to restrict user interactions to specific functions, making it perfect for public kiosks. However, in the case of this attack, kiosk mode is misused to confine user actions to the Google login page, presenting the sole option of entering account credentials This tactic aims to frustrate users into entering their credentials and "unlocking" the