TL;DR: infirc.com and infird.com extension-injected referer with rotating user agents
- Referer spike, real cause: Every analytics dashboard reads a spike in referer traffic as either affiliate luck or an attack on your site, but 145 requests in a single day from infirc.com, each with a distinct user agent, means something else: an extension injecting itself into your visitors' sessions.
- How cside mapped it: cside's public domain directory indexed infirc.com and infird.com as they appeared, the internal engine flagged both as malicious against the same script that also called AliExpress, rano.info, zurano.info, and google-analytics.com Measurement Protocol, and we tracked traffic from the Czech Republic, China, London VPNs, and Japan.
- Still in PCI scope: The script explicitly skips Google, Bing, and other high-defense environments. CSP would not have caught it, and visitor-side extension injection still falls inside your PCI DSS 6.4.3 and 11.6.1 scope, even though the code was never in your repo.
Short on time? See cside's in-browser Magecart and skimmer blocking. It covers everything below in one deployment.
The domain infirc[.]com and infird[.]com have caused quite the stir recently, and highlighted the dangers of infected or malicious web extensions.
Infirc[.]com was first observed coming into our backend appearing as the referer header, even though it is not hosted or referenced by our site.
Our public domains directory indexed the domain right after, and our internal detection engine flagged it as potentially malicious.
Infirc[.]com is a newly registered domain with no clear purpose or established reputation.
A few weeks after, we noticed a significant increase in search impressions and clicks on this page, indicating that people were researching this domain. This prompted us to dive deeper.
A malicious domain inside a web extension (plugin)
As per the source, it suggests that script was found on cside, but we are not infected. The only other possibility is visits from a browser with a web extension that tries to inject code.
In some cases, extension IDs are leaked. In this case, we weren't able to find one.
If someone's web extension is infected, or an attacker creates one, they can be used to attack websites. For example, you have an ecommerce website that allows visitors to create accounts and perform transactions. A visitor with an infected web extension buys a product. In that process, their PII and financial details are captured by the malicious 3rd party script inside the infected extension.
Alternatively, a malicious extension use bot-traffic to capture any kind of information it's not supposed to access.
We noticed an influx of proxy requests originating from different IP addresses across the globe, including:
- Czech Republic
- China
- London (via VPN)
- Japan
The logs from September 17, 2024, show the earliest trace of infirc[.]com making requests to our backend. As time progressed, especially around October 13, 2024, we observed 145 proxy requests directed toward this domain in a single day.
Each request presented a different user agent, making it difficult to pinpoint a single source of activity. Likely bot-driven traffic or a coordinated attack through a range of user agents and VPNs.
On October 15th, we caught and indexed infird[.]com, which showed similarity.
The malicious scripts loaded by the domains
Digging deeper revealed a complex network of scripts, extensions, and external domains. Both infirc[.com] and infird[.com] host the same script, as can be seen from both these pages:
- https://infird[.]com/cdn/afde4f0c-4096-4aeb-b345-d1aea539851b
- https://infirc[.]com/cdn/c7fa7451-6f95-4815-ac32-b8cc2537837a
Both scripts referenced AliExpress and another domain, rano[.]info. The latter could be an ingest domain used to collect, process, or receive data from external sources.
The analysis of the scripts revealed attempts to bypass common detection mechanisms. Both domains load external scripts from untrusted sources like:
- zurano[.]info/zimblat?i=7OB7CVF5V7&atr=477978779The domain zurano[.]info was flagged as neither legitimate nor associated with any trusted services.
The script was also seen transmitting data to other external servers, including:
- https://overbridgenet[.]com/jsv8/offer
- Google Analytics via the Measurement Protocol: https://www.google-analytics[.]com/mp/collect
This behavior shows that infirc[.]com loads unauthorized scripts and sends data to various external servers, possibly to track users or manipulate analytics.
Two functions, _0xfc929c() and _0x1238ee(), were identified in the code, suggesting that the script might be trying to:
- Redirect users to different URLs.
- Modify links or interactions on the page without user consent.
This type of behavior shows of a possible attempt to alter the browsing experience of users or to phish sensitive information by redirecting them to malicious sites.
The script includes specific checks to avoid running in particular environments, such as platforms like Google, Bing, and other social media networks, to avoid detection in high-profile, well-defended environments.
CSPs are widely used as a first layer of protection against client-side attacks, including these. Attackers know about them, and can easily circumvent it. We don't rely on CSPs and were able to detect it.
How to protect your site
Please check your code for any reference to these domains and remove them. However, this is almost certainly a malicious 3rd party script that's trying to be injected from outside.
We can block these attempts, though attackers who know about cside's presence can also circumvent us. This is an attack coming from a visitor's browser, not malicious 3rd party code already present on your own site. We can still detect it and share information with you, including IPs and time of the attempts.
Any 3rd party scripts present on your site that are compromised, we can detect and block before they execute in the browser of your visitors. Protecting them, and you, from malicious actors.
By using our free tier, you are safe from this and other similar attacks.
