Guardio Labs
labs.guard.io · Company blog · on HN since 2023
Guardio Labs, the research team at security company Guardio, writes about phishing, malicious browser extensions, ad abuse and web3-based malware.
What HN saysHN commenters link it as the source for specific attack write-ups, such as EtherHiding and phishing campaigns that pass SPF, DKIM and DMARC checks.
16HN people shared it
2linked it in comments
16stories submitted
38story points
2 years agolast shared
2023people per year2026
Most-shared posts
- 1Phishing Campaign Exploits Proofpoint to Send Spoofed Emails4 people · 16 points · first shared 2024 · 1 comments on HN
- 2"EtherHiding" – Hiding Web2 Malicious Code in Web3 Smart Contracts4 people · 3 points · first shared 2023 · discussion on HN
- 3Exploring Telegram's Dark Markets: ground for Modern Phishing Operations1 people · 4 points · first shared 2024 · 1 comments on HN
- 4Exploiting 0-Day Opera Vulnerability with a Cross-Browser Extension Store Attack1 people · 3 points · first shared 2024 · discussion on HN
- 5Microsoft Edge's Marketing API Exploited for Covert Extension Installation1 people · 3 points · first shared 2024 · discussion on HN
- 6“FakeGPT”: Malicious Chrome Extension Stealing Facebook Ad Accounts1 people · 2 points · first shared 2023 · discussion on HN
- 7Microsoft Edge's Marketing API Exploited for Covert Extension Installation1 people · 2 points · first shared 2024 · discussion on HN
- 8"DeceptionAds" – A Glimpse to the Dark Side of Internet Advertising1 people · 1 points · first shared 2024 · discussion on HN
- 9“MasquerAds” – Google’s Ad-Words Abused by Threat Actors1 people · 1 points · first shared 2023 · discussion on HN
- 10Vulnerability in Salesforce email services used to phish Facebook accounts1 people · 1 points · first shared 2023 · discussion on HN
- 11“Malverposting”: Facebook Ads Fuel This Evolving Stealer Campaign1 people · 1 points · first shared 2023 · discussion on HN
- 12"MyFlaw" – Cross Platform 0-Day RCE Vulnerability Discovered in Opera's Browser1 people · 1 points · first shared 2024 · discussion on HN
What HN people wrote when they linked it
warkdarrior · 2023-10-18
According to the following blog post, it uses a web API exposed by the Binance Smart Chain (BSC) platform:
https://labs.guard.io/etherhiding-hiding-web2-malicious-code-in-web3-s…
This diagram show the full flow of the attack:
https://miro.medium.com/v2/resize:fit:1400/format:webp/1*by4S5wz1jVZrx…
Because reads from blockchain are "free" (meaning, there is no cryptocurrency payment required to read data from the smart contracts on BSC), this is effectively free storage/hosting for the attacker.
The malicious code is served by BSC web API. According to the Krebs article, BSC "is aware of the malware abusing its blockchain, and is actively addressing the issue." I am not clear if they are taking this situation Very Seriously(TM), but I assume they are.
johnmaguire · 2025-02-28
I saw one of these emails too. It was sent by an onmicrosoft.com server, linked to a phishing site, but passed SPF/DKIM/DMARC for Paypal.
Microsoft obviously isn't "forging" it. It's valid: https://labs.guard.io/echospoofing-a-massive-phishing-campaign-exploit…