As reported, hackers allegedly modified the script at www.statcounter[.]com/counter/counter.js by inserting a malicious script. Since they added the code in the middle of the script (contrary to what most hackers do), it became difficult to track the change.
The added piece of code essentially looked up the “myaccount/withdraw/BTC" path in the page link. Hence it clearly indicated the hackers’ intention to target a cryptocurrency website. While StatCounter might be used on various websites, the researchers noticed that the attack specifically targeted the crypto exchange Gate.io. As stated in their report:
“…the script targets a specific Uniform Resource Identifier (URI): myaccount/withdraw/BTC. It turns out that among the different cryptocurrency exchanges live at time of writing, only gate.io has a valid page with this URI. Thus, this exchange seems to be the main target of this attack.”
“On Nov. 6, 2018, we got the notice from ESET researcher's report and the "ESET Internet Security" product that there's a suspicious behavior in Statcounter's traffic stats service. We immediately scanned it on Virustotal in 56 antivirus products.”Following the scan, the exchange removed the StatCounter tool. Moreover, they confirmed that funds remained safe during the incident. Nonetheless, they advised the users to employ 2FA for logging in to their accounts.
StatCounter also removed the malicious code from the script. While the matter seems resolved. Since the time the news about the breach surfaced online, Gate.io has been facing a decline in their rankings. At the time the news broke, the exchange resided at 39th position, only to reach 43 at the time of writing this article.
