debuggingmalware

Web app has some strings injected on customer's screen


Question may be a bit esoteric, however, I wouldn't have posted it had I not found so many clues leading to nowhere.

A cloud based web app works normally for everyone but a few people (possibly on the same network). There seems to be some kind of text injected in random places (note that the text disappears after a site refresh and appears in random intervals) as seen on the picture:

weird

Facts:

All the websites found with that string on Google look suspicious to say the least which leads me to the idea of it being caused by some kind of malware either server side (websites found on Google) or PC-side (the person viewing our website). Our website runs in the cloud and definitely securely enough for it to not be spoofed. There are no similarities in the websites on Google, neither with our web nor with each other.

How would one even begin debugging this?


Solution

  • At least for some of those websites, a zero with space U+200B is present in other languages where this strange string occurs in Slovak.

    enter image description here

    So it looks like some translation(?) engine incorrectly translates Zero width space character into Zrkadlovka na čiernom pozadí or for some other reason this invisible space is being replaced with a string.

    I would start checking if that is the same for you (if you have Zero width space), but the full analysis might be difficult w/o some internal details of your stack/packages and how the page is generated.

    Update: Don't know if you can use google translate (or other tools) to automatically translate your text with vuetify, but seeing how google translate the above text (with ZWSP at the end), it must be something like that.