Full Report
Discover how cybercriminals steal browser fingerprints to mimic users, bypass security measures, and commit online fraud. Learn how to protect your digital identity.
Analysis Summary
# Tool/Technique: Browser Fingerprinting & Mimicry (ScreamedJungle)
## Overview
This technique involves the illicit collection of unique browser attributes (fingerprints) to create a digital twin of a user. Cybercriminals use these stolen fingerprints to bypass anti-fraud systems, defeat risk-based authentication, and perform unauthorized transactions by appearing as a legitimate, returning user.
## Technical Details
- **Type**: Technique / Malware (Information Stealer)
- **Platform**: Web Browsers (Cross-platform: Windows, macOS, Linux, Mobile)
- **Capabilities**: Automated collection of metadata, Canvas API rendering, hardware specifications, and session cookies.
- **First Seen**: Variable; ScreamedJungle campaign active circa 2023-2024.
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1189 - Drive-by Compromise
- **TA0002 - Execution**
- T1059.007 - Command and Scripting Interpreter: JavaScript
- **TA0009 - Collection**
- T1119 - Automated Collection
- **TA0008 - Resource Development**
- T1588.005 - Obtain Capabilities: Exploits
## Functionality
### Core Capabilities
- **Data Exfiltration**: Scripts like `clientsafe.js` collect browser headers, screen resolution, time zones, and installed fonts.
- **Environment Mimicry**: Using stolen data to configure "Antidetect" browsers that trick websites into seeing the victim's hardware profile.
- **Bypassing Security**: Overcoming device-based trust scores and "remember this device" settings.
### Advanced Features
- **Canvas/WebGL Fingerprinting**: Forcing the browser to render hidden images to identify unique GPU and driver nuances.
- **Behavioral Automation**: Using tools like Browser Automation Studio (BAS) to mimic human interactions (mouse movements, typing rhythms) alongside the stolen fingerprint.
## Indicators of Compromise
- **File Hashes (SHA256)**:
- `dcc1122bcf60d91acae0703de18ed4ac027f6d3d55eebd1e87c4f4647b2daeca`
- **File Names**:
- `clientsafe.js`
- **Network Indicators**:
- `busz[.]io`
- `hxxps://busz[.]io/j9z3GfPd?pr=1`
- `hxxps://busz[.]io/clientsafe.js`
- `screamedjungle[.]com`
- `hxxps://screamedjungle[.]com/mjzNTg?pr=1`
- `hxxps://screamedjungle[.]com/clientsafe.js`
## Associated Threat Actors
- **ScreamedJungle**: A group known for targeting vulnerable Magento e-commerce platforms to inject fingerprinting and skimming scripts.
## Detection Methods
- **Signature-based detection**: Monitoring for the SHA256 hash of known malicious scripts like `clientsafe.js`.
- **Behavioral detection**:
- Monitoring for unusual calls to the **Canvas API** (DS2057) or WebGL constants.
- Analyzing **Network Traffic Patterns** (DS2020) for unauthorized exfiltration to known C2 domains.
- **Dark Web Monitoring**: Checking for the sale of specific user session logs (logs containing cookies + fingerprints).
## Mitigation Strategies
- **Multi-Factor Authentication (MFA)**: High efficiency; prevents account takeover even if the fingerprint/session is compromised.
- **Device Binding**: Hard-coding specific hardware identifiers that are more difficult to spoof via software.
- **Security Hardening**:
- Patching e-commerce platforms (e.g., Magento) to prevent initial JS injection.
- Implementing Content Security Policy (CSP) to block scripts from unauthorized domains.
- **Geofencing**: Alerting on logins that originate from geographically impossible locations relative to the user's history.
## Related Tools/Techniques
- **Antidetect Browsers**: (e.g., Linken Sphere, AdsPower) Tools used by actors to apply stolen fingerprints.
- **Browser Automation Studio (BAS)**: A framework used to automate interactions within a mimicked browser environment.
- **Magecart**: Similar techniques involving malicious JS injection for financial data theft.