Full Report
A bookmarklet is a primitive version of a browser extension. It's a simple version of a browser extension that can contain JavaScript code. Users can add bookmarklets by creating a bookmark, pasting the bookmarklets code as a URL or dragging/dropping the link onto the toolbar. When the CSP came out in 2014, the idea was that the bookmarklets were going to die. However, this never happened, with references in the RFC for CSPs ignoring addons. Regardless of implementing a CSP or not, the bookmarklet can bypass this protections to interact with websites. These bookmarklets were used for phishing attacks. In particular, Discords in the cryptocurrency space were being hit by these attacks. These attacks worked by asking users to drag a button to their bookmarks bar. Once this happened, the JavaScript within the bookmarklet code can be accepted. With the admins knowledge within the account, the bookmarklet discreetly retrieved their Discord token when it was dragged, subsequently transmitting it to the attacker’s website. This led to posts on Discord channels with more malicious links and bookmarks. Overall, an interesting attack vector to consider; I had no idea that bookmarklets could execute code like this. I'm sure we'll see some response from the browsers soon.
Analysis Summary
# Tool/Technique: Bookmarklet-Based Phishing & CSP Bypass
## Overview
A bookmarklet is a "mini" browser extension stored as a URI within a bookmark. It utilizes the `javascript:` protocol to execute code within the context of the currently open web page. In recent campaigns, threat actors have used bookmarklets to bypass Content Security Policies (CSP) to steal sensitive session information, specifically targeting cryptocurrency communities on Discord.
## Technical Details
- **Type:** Technique (Subversion of browser features)
- **Platform:** Cross-platform (Web Browsers: Chrome, Firefox, Edge, Safari)
- **Capabilities:** JavaScript execution, CSP bypass, Data exfiltration (Tokens/Cookies), UI manipulation.
- **First Seen:** Conceptually old; recent surge in Discord-themed attacks noted in 2023-2024.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link]
- **[TA0002 - Execution]**
- [T1204.001 - User Execution: Malicious Link]
- **[TA0005 - Defense Evasion]**
- [T1548 - Abuse Elevation Control Mechanism] (Bypassing CSP)
- **[TA0006 - Credential Access]**
- [T1539 - Steal Web Session Cookie]
- [T1555 - Credentials from Web Browsers]
## Functionality
### Core Capabilities
- **CSP Bypass:** Browser implementations typically exempt bookmarklets from Content Security Policy (CSP) restrictions, allowing them to execute scripts on pages where third-party scripts are otherwise blocked.
- **Contextual Execution:** Runs within the Document Object Model (DOM) of the active site, providing full access to the page's data and the user's local session storage.
- **Token Theft:** Specifically designed to programmatically access `localStorage` or `sessionStorage` to retrieve Discord authentication tokens.
### Advanced Features
- **Social Engineering Integration:** Attackers use "Drag-and-Drop" lures, asking users to move a malicious button to their bookmarks bar to access "exclusive features" or "verification tools."
- **Worm-like Propagation:** Once an administrator's account is compromised, the bookmarklet (via the attacker) uses the stolen token to post the same malicious link in all channels the admin manages.
## Indicators of Compromise
- **File Hashes:** N/A (Script-based, resides in browser metadata).
- **File Names:** N/A.
- **Registry Keys:** N/A.
- **Network Indicators:**
- Exfiltration endpoints (e.g., `https[:]//attacker-domain[.]com/log?token=...`)
- Webhooks used for data collection (e.g., `https[:]//discord[.]com/api/webhooks/...`)
- **Behavioral Indicators:**
- Users dragging links to the Bookmarks/Favorites bar.
- Unexpected `javascript:` prefix in saved bookmark URLs.
- Outbound requests to unknown domains originating from a Discord browser tab.
## Associated Threat Actors
- **Cryptocurrency Scammers:** Unnamed groups specifically targeting Decentralized Finance (DeFi) and NFT Discord servers.
## Detection Methods
- **Signature-based detection:** Scan browser `Bookmarks` files (located in User AppData profiles) for the `javascript:` string followed by obfuscated code or keywords like `window.localStorage.getItem("token")`.
- **Behavioral detection:** Monitor for unauthorized API calls to Discord’s internal endpoints originating from non-standard sources.
- **Telemetry:** Audit browser logs for the execution of the `javascript:` protocol from the address bar or bookmarks.
## Mitigation Strategies
- **User Education:** Train users to never "drag and drop" buttons into their bookmarks bar at the request of a third party.
- **Browser Hardening:** In enterprise environments, use Group Policy (GPO) to disable the execution of JavaScript from the address bar or restrict bookmark editing.
- **Credential Rotation:** If a token is suspected of being compromised, users must change their passwords immediately to invalidate all current session tokens and enable Multi-Factor Authentication (MFA).
## Related Tools/Techniques
- **Cross-Site Scripting (XSS):** Bookmarklets essentially function as a "Self-XSS" vector.
- **Malicious Browser Extensions:** While similar, bookmarklets are easier to distribute as they do not require hosting on the Chrome Web Store or manual developer mode installation.
- **Clickjacking:** Used to trick users into performing the drag-and-drop action.