Listen to this Post
Introduction:
A sophisticated malvertising campaign is exploiting the growing popularity of AI-powered browsers, specifically targeting users searching for Comet browser by Perplexity. Cybercriminals are purchasing Google Ads that redirect through multiple domains to ultimately deliver DarkGate malware via a malicious GitHub repository, highlighting the evolving threat landscape where even trusted platforms become attack vectors.
Learning Objectives:
- Understand the technical indicators of compromise (IOCs) associated with this malvertising campaign
- Learn defensive commands and techniques to detect and prevent similar attacks
- Develop strategies for verifying software downloads and identifying malicious infrastructure
You Should Know:
1. Malicious Domain Analysis and Blocking
`sudo iptables -A OUTPUT -p tcp -d cometswift[.]com -j DROP`
`sudo iptables -A OUTPUT -p tcp -d perplexity[.]page -j DROP`
`sudo iptables -A OUTPUT -p tcp -d icantseeyou[.]icu -j DROP`
Step-by-step guide: These iptables commands immediately block all outbound traffic to the known malicious domains associated with this campaign. The first command blocks the initial redirect domain (cometswift), the second blocks the intermediate domain (perplexity.page), and the third blocks the C2 server (icantseeyou.icu). Apply these rules to your firewall configuration to prevent any communication with the attacker’s infrastructure.
2. GitHub Repository Security Scanning
`git clone https://github.com/richardsuperman/musical-engine`
`find . -name “.msi” -exec file {} \;</h2>
<h2 style="color: yellow;">strings comet_latest.msi | grep -E “(http|https)://”`
<h2 style="color: yellow;">
Step-by-step guide: This process helps analyze suspicious GitHub repositories. First, clone the repository to examine its contents. Then use the find command to locate any MSI installer files. Finally, extract strings from the MSI file to identify potential malicious URLs or C2 connections that might be embedded in the binary.
3. Windows MSI File Integrity Verification
`Get-FileHash -Path “comet_latest.msi” -Algorithm SHA256`
`Get-AuthenticodeSignature -FilePath “comet_latest.msi”`
`msiexec /a “comet_latest.msi” /lv install_log.txt`
Step-by-step guide: These PowerShell commands help verify MSI files before installation. The first command generates a SHA256 hash that can be compared against known good versions. The second checks the digital signature validity. The third performs an administrative installation with verbose logging to examine what the installer actually does without fully executing potentially malicious code.
4. Network Traffic Analysis for C2 Detection
`tcpdump -i any -w capture.pcap host icantseeyou[.]icu`
`tshark -r capture.pcap -Y “dns.qry.name contains icantseeyou”`
`netstat -an | findstr “:443 :80 :8080″`
Step-by-step guide: Use tcpdump to capture all network traffic to and from the C2 domain, then analyze with tshark to filter DNS queries. The netstat command helps identify established connections to common C2 ports. This methodology can detect beaconing behavior and data exfiltration attempts.
5. VirusTotal API Integration for Automated Scanning
`curl -X GET “https://www.virustotal.com/api/v3/urls/” -H “x-apikey: YOUR_API_KEY”`
`vt file https://github.com/richardsuperman/musical-engine/releases/download/beta/comet_latest.msi`
`vt domain icantseeyou.icu`
Step-by-step guide: These commands demonstrate using VirusTotal’s API to automatically scan suspicious URLs and files. Replace YOUR_API_KEY with your actual VT API key. The vt commands (using vt-cli) provide quick threat intelligence about specific indicators, helping security teams rapidly assess potential threats.
6. Browser Security Hardening Against Malvertising
`reg add “HKCU\Software\Policies\Google\Chrome” /v AdsSettingForIntrusiveSites /t REG_DWORD /d 2`
`Get-AppxPackage Microsoft.Advertising | Remove-AppxPackage`
`uBlock Origin: ||googleads.g.doubleclick.net^$third-party`
Step-by-step guide: These commands harden browsers against malicious ads. The first disables intrusive ads in Chrome via registry, the second removes Windows advertising components, and the third shows uBlock Origin filter syntax to block Google’s ad networks entirely, preventing malvertising from loading.
7. Enterprise-Level Domain Blocking via Hosts File
`echo “0.0.0.0 cometswift.com” >> %systemroot%\system32\drivers\etc\hosts`
`echo “0.0.0.0 perplexity.page” >> %systemroot%\system32\drivers\etc\hosts`
`echo “0.0.0.0 icantseeyou.icu” >> %systemroot%\system32\drivers\etc\hosts`
`ipconfig /flushdns`
Step-by-step guide: This approach blocks malicious domains at the host level by redirecting them to localhost. Append each malicious domain to the hosts file, then flush DNS cache to ensure immediate effect. This provides an additional layer of protection beyond browser-based blocking.
What Undercode Say:
- The Russian-language artifacts in the GitHub repository suggest nation-state involvement or at least Eastern European cybercriminal operations
- Google’s advertising platform continues to be exploited despite repeated security improvements, indicating fundamental flaws in ad verification processes
- The multi-stage redirection through legitimate platforms (GitHub) demonstrates sophisticated OPSEC by threat actors
This campaign represents a significant evolution in malvertising tactics, specifically targeting the growing AI browser market. The use of GitHub as a final payload delivery mechanism is particularly concerning, as it exploits trust in the development platform. The connection to both DarkGate and CastleLoader malware families suggests either collaboration between threat groups or the reuse of infrastructure by multiple actors. The technical sophistication shown in the Russian-language code artifacts indicates experienced developers are behind this operation, potentially with state sponsorship or at least significant criminal resources. The persistence of such campaigns despite security community reporting highlights the economic incentives driving malvertising and the challenges platform providers face in balancing revenue with security.
Prediction:
The success of this AI browser-targeted malvertising campaign will likely spawn similar attacks against other emerging AI tools and agentic platforms. We predict increased abuse of developer platforms like GitHub, GitLab, and package repositories as final payload destinations, as they inherently carry trust with technical users. Within 6-12 months, we expect to see AI-generated malvertising copy that’s virtually indistinguishable from legitimate ads, combined with more sophisticated social engineering targeting specific professional communities. The cybersecurity industry will need to develop new AI-powered detection systems specifically designed to identify malicious advertising patterns across major platforms.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Jeromesegura Darkgate – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
