Madgicx Plus Ad Hijack Campaign

MadgicxSession HijackingMeta Business Account TheftFake Ad Tools

A malicious threat actor group is tricking Meta advertisers into installing fake Chrome extensions like Madgicx Plus and SocialMetrics Pro. These extensions are disguised as tools to optimize ads or unlock verification, but they steal login tokens and session cookies. Attackers then hijack Meta Business and Ad accounts for profit.

Indicators of Compromise

Hashes (2)

eaebd30ad9860b54b076c3e1241fc59c2c7c86c7bf568c4a6fece9cda904e65c7640907d54d5d76a25d19429968ff6b1d8fdae232b481df15d3cc47d1a224083

IPv4 (1)

185.245.104.195

Notes

<div class="content-body"> CONCLUSION The “Madgicx Plus Ad Hijack Campaign” is a sophisticated social engineering and extension-based threat targeting Meta advertisers. Attackers impersonate ad optimization tools (e.g. fake “Madgicx Plus” or “SocialMetrics Pro”) to install malicious Chrome extensions. These extensions steal session cookies and access tokens, enabling account hijack and abuse of Meta Business/Ads assets. The campaign uses polished websites, domain reuse, and bypass techniques to appear legitimate. Defenders need more than reactive measures. They must monitor threat actor behavior, track malicious infrastructure, detect unusual session or ad account activity, and enforce strict extension policies. SOCRadar’s platform helps organizations respond more effectively. For example: <ul> <li> SOCRadar LABS offers a Campaigns feed (see SOCRadar Labs → Campaigns) which tracks active campaigns like this one, giving early warning on infrastructure, IOCs, and actor TTPs. <a href="https://">(</a><a href="https://socradar.io/labs/campaigns/">SOCRadar LABS Campaigns</a>)<a href="https://socradar.io/labs/campaigns/?utm_source=chatgpt.com"> </a><a href="https://socradar.io/labs/campaigns/">SOCRadar® Cyber Intelligence Inc.</a><a href="https://socradar.io/labs/campaigns/?utm_source=chatgpt.com"> </a> </li> <li> The Cyber Threat Intelligence module provides enriched IOCs, threat actor tracking, and operational intelligence that can be directly applied to detection and response. For instance, identifying fake extension names, monitoring suspicious domains, and correlating them with session hijacks. (<a href="https://socradar.io/products/cyber-threat-intelligence/">SOCRadar Cyber Threat Intelligence</a>)<a href="https://socradar.io/products/cyber-threat-intelligence/?utm_source=chatgpt.com"> </a><a href="https://socradar.io/products/cyber-threat-intelligence/?utm_source=chatgpt.com">S</a><a href="https://">OCRadar® Cyber Intelligence Inc.</a><a href="https://socradar.io/products/cyber-threat-intelligence/?utm_source=chatgpt.com"> </a> </li> </ul> By combining SOCRadar’s intelligence with strong internal controls (extension governance, session monitoring, least privilege), organizations can reduce risk, shorten detection time, and respond more proactively to campaigns like Madgicx Plus. <div> </div> </div>

Mitigation

<div class="content-container"> <div> <table> <colgroup> <col> <col> <col> </colgroup> <tbody> <tr> <th>ID</th> <th>Mitigation</th> <th>Description</th> </tr> <tr> <td> <a href="https://attack.mitre.org/mitigations/M1047">M1047</a> </td> <td> <a href="https://attack.mitre.org/mitigations/M1047">Audit</a> </td> <td> Review authentication logs to ensure that mechanisms such as enforcement of MFA are functioning as intended. Periodically review the hybrid identity solution in use for any discrepancies. For example, review all Pass Through Authentication (PTA) agents in the Azure Management Portal to identify any unwanted or unapproved ones.<a href="https://www.mandiant.com/resources/detecting-microsoft-365-azure-active-directory-backdoors">[6]</a> If ADFS is in use, review DLLs and executable files in the AD FS and Global Assembly Cache directories to ensure that they are signed by Microsoft. Note that in some cases binaries may be catalog-signed, which may cause the file to appear unsigned when viewing file properties.<a href="https://www.microsoft.com/security/blog/2022/08/24/magicweb-nobeliums-post-compromise-trick-to-authenticate-as-anyone/">[7]</a> Periodically review for new and unknown network provider DLLs within the Registry (HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<NetworkProviderName>\NetworkProvider\ProviderPath). Ensure only valid network provider DLLs are registered. The name of these can be found in the Registry key at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order, and have corresponding service subkey pointing to a DLL at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<NetworkProviderName>\NetworkProvider. </td> </tr> <tr> <td> <a href="https://attack.mitre.org/mitigations/M1032">M1032</a> </td> <td> <a href="https://attack.mitre.org/mitigations/M1032">Multi-factor Authentication</a> </td> <td> Integrating multi-factor authentication (MFA) as part of organizational policy can greatly reduce the risk of an adversary gaining control of valid credentials that may be used for additional tactics such as initial access, lateral movement, and collecting information. MFA can also be used to restrict access to cloud resources and APIs. </td> </tr> <tr> <td> <a href="https://attack.mitre.org/mitigations/M1028">M1028</a> </td> <td> <a href="https://attack.mitre.org/mitigations/M1028">Operating System Configuration</a> </td> <td> Ensure only valid password filters are registered. Filter DLLs must be present in Windows installation directory (C:\Windows\System32\) of a domain controller and/or local computer with a corresponding entry in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages. Starting in Windows 11 22H2, the EnableMPRNotifications policy can be disabled through Group Policy or through a configuration service provider to prevent Winlogon from sending credentials to network providers.<a href="https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-windowslogon">[8]</a> </td> </tr> <tr> <td> <a href="https://attack.mitre.org/mitigations/M1027">M1027</a> </td> <td> <a href="https://attack.mitre.org/mitigations/M1027">Password Policies</a> </td> <td> Ensure that AllowReversiblePasswordEncryption property is set to disabled unless there are application requirements.<a href="https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/store-passwords-using-reversible-encryption">[9]</a> </td> </tr> <tr> <td> <a href="https://attack.mitre.org/mitigations/M1026">M1026</a> </td> <td> <a href="https://attack.mitre.org/mitigations/M1026">Privileged Account Management</a> </td> <td> Audit domain and local accounts as well as their permission levels routinely to look for situations that could allow an adversary to gain wide access by obtaining credentials of a privileged account. <a href="https://technet.microsoft.com/en-us/library/dn535501.aspx">[10]</a> <a href="https://technet.microsoft.com/en-us/library/dn487450.aspx">[11]</a> These audits should also include if default accounts have been enabled, or if new local accounts are created that have not be authorized. Follow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers. Limit access to the root account and prevent users from modifying protected components through proper privilege separation (ex SELinux, grsecurity, AppArmor, etc.) and limiting Privilege Escalation opportunities. </td> </tr> <tr> <td> <a href="https://attack.mitre.org/mitigations/M1025">M1025</a> </td> <td> <a href="https://attack.mitre.org/mitigations/M1025">Privileged Process Integrity</a> </td> <td> Enabled features, such as Protected Process Light (PPL), for LSA.<a href="https://technet.microsoft.com/en-us/library/dn408187.aspx">[13]</a> </td> </tr> <tr> <td> <a href="https://attack.mitre.org/mitigations/M1022">M1022</a> </td> <td> <a href="https://attack.mitre.org/mitigations/M1022">Restrict File and Directory Permissions</a> </td> <td> Restrict write access to the /Library/Security/SecurityAgentPlugins directory. </td> </tr> <tr> <td> <a href="https://attack.mitre.org/mitigations/M1024">M1024</a> </td> <td> <a href="https://attack.mitre.org/mitigations/M1024">Restrict Registry Permissions</a> </td> <td> Restrict Registry permissions to disallow the modification of sensitive Registry keys such as HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order. </td> </tr> <tr> <td> <a href="https://attack.mitre.org/mitigations/M1018">M1018</a> </td> <td> <a href="https://attack.mitre.org/mitigations/M1018">User Account Management</a> </td> <td> Ensure that proper policies are implemented to dictate the the secure enrollment and deactivation of authentication mechanisms, such as MFA, for user accounts. </td> </tr> </tbody> </table> </div> <div> <table> <colgroup> <col> <col> <col> </colgroup> <tbody> <tr> <th>ID</th> <th>Mitigation</th> <th>Description</th> </tr> <tr> <td> <a href="https://attack.mitre.org/mitigations/M1047">M1047</a> </td> <td> <a href="https://attack.mitre.org/mitigations/M1047">Audit</a> </td> <td> Ensure extensions that are installed are the intended ones, as many malicious extensions may masquerade as legitimate ones. </td> </tr> <tr> <td> <a href="https://attack.mitre.org/mitigations/M1038">M1038</a> </td> <td> <a href="https://attack.mitre.org/mitigations/M1038">Execution Prevention</a> </td> <td> Set an extension allow or deny list as appropriate for your security policy. </td> </tr> <tr> <td> <a href="https://attack.mitre.org/mitigations/M1033">M1033</a> </td> <td> <a href="https://attack.mitre.org/mitigations/M1033">Limit Software Installation</a> </td> <td> Ensure only authorized software can be installed in the environment. Implement a software inventory listing that includes all approved and unapproved software. </td> </tr> </tbody> </table> </div> </div>