4

I have been receiving messages from relatives that goes like this:

AirAsia is rewarding everyone with 2 free plane tickets to celebrate 24 Years of quality service. Get your free ticket at: http://airasîa.com/free-tickets/ .

which is a unicode link to http://xn--airasa-fwa.com/free-tickets/

I am just really curious how a click on this link on phone could allow hackers to hijack my friends and relatives Whatsapp accounts? Trying to access this site on PC gives me a 404 error.

In the mean time I have asked those who sent me this message to use Whatsapp settings to log out from all computer sessions. Is that enough?


Update 1:

I traced the phishing link to http://com-cupons.com/aa/, which uses js to redirect to http://aldi-com-2018.com/aa/. This is the URL containing the actual contents my friends were looking at.

There was a link like this:

<a href="whatsapp://send?text=*AirAsia is rewarding everyone with 2 free plane tickets* to celebrate 24 Years of quality service. Get your free ticket at : http://airasîa.com/free-tickets/  .">

So I suppose that's why I am receiving those messages.

But I still can't figure out the intent of this phishing. Maybe it has something to do with this?

  <script type="text/javascript">
  (function(){
  var foxscript = document.createElement('script');
  foxscript.src = '//js.foxpush.com/aldi-com-2018com.js?v='+Math.random();
  foxscript.type = 'text/javascript';
  foxscript.async = 'true';
  var fox_s = document.getElementsByTagName('script')[0];
  fox_s.parentNode.insertBefore(foxscript, fox_s);})();
  </script>
      <body oncontextmenu="return false">
          <!-- Global site tag (gtag.js) - Google Analytics -->
          <script async src="https://www.googletagmanager.com/gtag/js?id=UA-91015564-3"></script>
          <script>
    window.dataLayer = window.dataLayer || [];
    function gtag(){dataLayer.push(arguments);}
    gtag('js', new Date());

    gtag('config', 'UA-91015564-3');
  </script>

What does it actually do?


Update 2:

Found out the phishing site actually tries to redirect users to final.html under the same aldi-com-2018 domain. The site contains obfuscated javascript that I have no idea how to decipher, but it does contain this piece of code:

<script data-cfasync="false" type="text/javascript" src="//go.onclasrv.com/apu.php?zoneid=956139" async onerror="_tyzjj()" onloaded="_rxnhqlpp()"></script>

Google search on onclasrv returns bunch of adware related results. I'm guessing that is the final intention then?

closed as off-topic by Eric G, schroeder Jan 24 '18 at 9:58

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Eric G, schroeder
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    Analysing random malware or code on random sites is off-topic here. You can imagine that we would be flooded with a lot of code. – schroeder Jan 23 '18 at 11:29