{"id":97011,"date":"2019-10-04T13:02:32","date_gmt":"2019-10-04T20:02:32","guid":{"rendered":"https:\/\/securingtomorrow.mcafee.com\/?p=97011"},"modified":"2025-08-29T01:57:55","modified_gmt":"2025-08-29T08:57:55","slug":"ghostcat-malware","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/internet-security\/ghostcat-malware\/","title":{"rendered":"Is Your Browser Haunted With Ghostcat Malware?"},"content":{"rendered":"

October is finally among us, and things are spookier than usual. One ghost causing some hocus pocus across the World Wide Web is Ghostcat-3PC, a browser-hijacking malware that has launched at least 18 different malvertising campaigns in the last three months. According to SC Magazine<\/a>, Ghostcat\u2019s goal is to hijack users\u2019 mobile browsing sessions and is specifically targeting website visitors in the U.S. and Europe.<\/p>\n

How exactly does this ghost begin its haunting? The infection begins when a user visits a particular website and is served a malicious advertisement. When this occurs, Ghostcat fingerprints the browser<\/a>, which is when information is collected about a device for the purpose of identification, to determine if the ad is running on a genuine webpage. Ghostcat also checks if the ad is running on one of the over 100 online publishers\u2019 pages that have been specifically targeted by this campaign. If both of these conditions are met, then the malware serves a malicious URL linked to the ad.<\/p>\n

\"\"<\/p>\n

From there, this malicious URL delivers obfuscated JavaScript, which creates an obscure source or machine code. The attackers behind Ghostcat use this technique to trick the publishers’ ad blockers, preventing them from detecting malicious content. The code also checks for additional conditions necessary for the attack. These conditions include ensuring that the malware is being run on a mobile device and a mobile-specific browser, that the device is located in a targeted country, and that it is being run on a genuine website as opposed to a testing environment. If the malware concludes that the browsing environment fits the descriptions of their target, then it will serve a fraudulent pop-up, leading the user to malicious content.<\/p>\n

Tips to Avoid Malware<\/h2>\n

So, what are some proactive steps users can take to avoid being haunted by Ghostcat? Follow these tips to avoid the malware\u2019s hocus pocus:<\/p>\n