Hackers are taking advantage of dozens of educational websites to poison search engine results, deliver phishing sites to victims, and engage in all kinds of fraudulent activity.
The websites being abused in this campaign include MIT, Columbia University, Universitat de Barcelona, Auburn University, University of Washington, Purdue, Tulane, Universidad Central del Ecuador, and the University of Hawaiʻi.
Besides government sites, the campaign also targeted government and corporate websites, such as the site of the Government of Virginia, Austin, Texas, the website of the Government of Spain, and Yellow Pages Canada.
There are no free VBucks
The scheme was revealed by cybersecurity researcher @g0njxa, who posted on X a report outlining how they found websites using FCKeditor, a web text editor that allowed users to edit HTML content inside a web page.
Apparently, it was a popular solution a decade and half ago, but it rebranded to CKEditor in 2009. Responding to the findings, the CKEditor X profile said FCKeditor died in 2010 and should not be in use at all due to various security issues.
One of the security issues being exploited here is called open redirect, a feature that allows arbitrary redirection requests that send a visitor to an external URL without validating or running appropriate security checks. With open redirects, search engines will show the site being redirected to, as being hosted by the victim site.
Showing an example, @g0njxa posted a screenshot of search engine results for “Free V Bucks” (Fortnite ingame currency), on which websites such as the Barcelona University, or Tulane, were seen “hosting” free VBucks generators.
Via BleepingComputer