Researchers discovered a watering hole attack distributing ScanBox, a JavaScript-based reconnaissance tool used by APT TA423. The attack compromises legitimate websites to inject malicious code targeting visitors.

ScanBox functions as a keylogger and information stealer, capturing user credentials, browser history, and system details. The tool operates entirely within the browser environment, making it difficult to detect through traditional endpoint security solutions. APT TA423, a Chinese state-sponsored group, has deployed ScanBox in previous campaigns against government and private sector targets.

Watering hole attacks work by poisoning websites frequented by a specific target audience. When visitors access the compromised site, their browsers execute the ScanBox payload automatically. This delivery method bypasses email filters and avoids direct communication with targets, reducing detection likelihood.

The attack chain begins with JavaScript code injection into legitimate websites. Victims unknowingly download and execute ScanBox through normal browsing. The reconnaissance tool then collects sensitive data without user knowledge or consent.

Organizations face significant risk from this attack vector. Employees accessing industry-specific websites or professional communities become infection vectors. The keylogging capability exposes credentials used for corporate systems, email, and cloud services. Collected browser history reveals internal workflows and security tools.

TA423 typically targets organizations in defense, energy, and telecommunications sectors. Previous campaigns demonstrated their focus on long-term network access and intellectual property theft.

Detection requires monitoring for unusual JavaScript execution patterns and monitoring outbound connections from browser processes. Network teams should analyze traffic from compromised websites for suspicious callback patterns. Organizations should implement content security policies restricting script execution from untrusted domains.

Users should keep browsers fully patched, disable JavaScript in email clients, and use browser isolation technology for high-risk web browsing. Security teams should monitor for ScanBox indicators: specific callback domains, unusual JavaScript file sizes, and reconnaissance-