Threat Hunt of the Month: Browser Session Hijacking via Malvertising

In January 2025, GoSecure Threat Hunters identified a new browser hijacking campaign leveraging malware dubbed

Why This Matters 

Unlike traditional malware that aims to steal credentials or deploy ransomware, MEDIAARENA silently alters browser behavior, making detection difficult while maintaining persistent access to user activity. By using hidden browser windows and remote debugging techniques, attackers gain unauthorized access to browser cookies and search engine settings, allowing them to manipulate user traffic, conduct targeted phishing, and collect sensitive browsing data. The covert nature of this attack highlights the increasing sophistication of browser hijacking techniques. 

Detection and Monitoring 

GoSecure’s Threat Hunters hypothesized that adversaries were leveraging Chromium’s remote debugging functionality to access browser cookies and manipulate search behavior. After confirming adversary presence, GoSecure developed a high-severity detection rule to flag suspicious browser activity: 

• Detection Rule: Hidden Browser Launched with Remote Debugging 

• • Description: Detects when Google Chrome or Microsoft Edge is spawned with remote debugging enabled and a hidden window size, which may indicate unauthorized access to browser cookies or search engine tampering. 

Recommendations 

To mitigate the risks posed by this malware, GoSecure recommends the following measures: 

• Educate users on the dangers of installing third-party software from untrusted sources. 
• Regularly review browser settings to detect and remove unauthorized search engine modifications. 
• Block known malicious domains associated with MEDIAARENA, including cast[.]sklitright[.]com. 
• Enhance endpoint monitoring to detect suspicious browser behavior, such as remote debugging activity. 

Conclusion 

The January Threat Hunt highlights the increasing sophistication of browser-based cyber threats and the importance of proactive threat hunting and detection. GoSecure’s MXDR service provides continuous monitoring and advanced detection capabilities to identify and mitigate evolving threats like MEDIAARENA before they impact business operations. 

For further details on bolstering your defenses or to discuss our findings and recommendations, please contact us at (888)-287-5858 or info@gosecure.ai. 

Stay secure! 

Your GoSecure Threat Hunting Team