Hackers Clone Legitimate Websites to Silently Trigger Chrome and Windows Zero-Day Exploits

Hackers are using convincing copies of trusted websites to turn an ordinary browser visit into a full Windows compromise. The campaign pairs targeted phishing emails with a chained set of previously unknown flaws in Google Chrome and Microsoft Windows, giving attackers a quiet path from a fake page to malware on a victim’s device. The activity was recorded on September 3 and 4, before the affected flaws were patched. It targeted Asian government entities with a Chinese-language message about jailed Hong Kong activist Chow Hang-tung, while another lure impersonated the Center for American Progress. The apparent goal was not mass disruption, but carefully selected access for espionage. Analysts at Volexity identified the...

Read the full article at the source.