Video Proof of Concept

Chrome 0-day exploit CVE-2019-13720

The attack leverages a waterhole-style injection on a website/blog/portal. A malicious JavaScript code was inserted in the main page, which in turn, loads a profiling script from a remote site.

Payload decrypt by shellcode with RC4, the malware module is dropped as execute file and executed.