jQuery

Summary

The jQuery website was compromised in a malware attack targeting privileged enterprise IT accounts, leveraging the trusted platform to distribute malicious payloads. Attackers injected code redirecting visitors to exploit kits that installed credential-stealing malware, enabling unauthorized access to corporate networks. This watering hole technique exploited the site's credibility, impacting organizations relying on its resources. The incident highlighted risks associated with third-party web dependencies and the potential for supply chain attacks to compromise high-value accounts through seemingly legitimate channels. Security researchers identified the campaign's focus on harvesting authentication details to facilitate lateral movement within enterprise environments.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On September 23, 2014, attackers compromised the official jQuery website (jQuery.com) to distribute malware targeting privileged enterprise IT accounts. The incident exposed organizations to credential theft and unauthorized access through compromised administrative credentials. Attackers leveraged the trusted reputation of the jQuery domain to deliver malicious payloads to visitors, focusing on high-value enterprise accounts with elevated system permissions. The malware campaign specifically endangered organizations relying on jQuery’s infrastructure for legitimate web development operations, exploiting the site’s widespread use across commercial and institutional environments. Security researchers identified the compromise through infrastructure analysis linking the domain to known threat actor patterns. The attack vector involved unauthorized modifications to jQuery.com’s content delivery mechanisms, though technical specifics regarding exploit methods weren’t disclosed in available reporting. Enterprise networks with users accessing jQuery.com during the active compromise window faced direct exposure to credential harvesting attempts.

Microsoft’s Defender Threat Intelligence platform provided visibility into the attack by mapping internet infrastructure connections associated with the incident. The system correlated jQuery.com’s malicious activity with broader attacker infrastructure through analysis of domain relationships and hosting patterns. Security teams utilized threat intelligence workbenches to share investigation findings across organizations and export indicators of compromise for defensive blocking. The platform processed internet-scale telemetry to identify jQuery.com’s role in the campaign alongside related domains and IP addresses operated by threat actors. Defender Threat Intelligence integrated with Microsoft Sentinel and Microsoft 365 Defender to contextualize internal security alerts involving the compromised domain. Analysis revealed connections between the jQuery.com compromise and larger attacker infrastructure clusters targeting enterprise environments. The incident underscored risks posed by supply chain attacks against widely trusted web development resources. Organizations implemented domain blocklists and enhanced monitoring for credential exfiltration attempts originating from affected accounts. Security operations centered on identifying compromised credentials and isolating potentially breached systems within enterprise networks.

Sources

Sources available to members: 1 source.