Caught in the funnel. [Research Saturday]

Summary

---

CyberWire Daily: "Caught in the Funnel" [Research Saturday]

Date: January 24, 2026
Host: Dave Bittner
Guest: Andrew Northern, Principal Security Researcher at Censys

---

Episode Overview

This Research Saturday episode dives deep into the evolving landscape of web-based cyberattacks, focusing on the "funneling" behavior observed in large-scale inject-based campaigns. Dave Bittner interviews Andrew Northern about his research, "From Evasion to Exploiting the Funneling Behavior of Injects," which uncovers how attackers leverage massive numbers of compromised websites to steer victims toward key infrastructure choke points—making attacks both scalable and difficult to block.

---

Key Discussion Points and Insights

The Shift to Web-Based Delivery

• Threat Evolution: Attackers are increasingly using web technologies for delivering both lures and malicious payloads, moving away from static methods like traditional email-based attacks.
  • Quote:
    "We're seeing adoption of web technologies as the way that threat actors are choosing to deliver both lures and payloads as opposed to traditional means of perhaps delivering static payloads through traditional avenues such as email."
    — Andrew Northern (02:08)

What Are "Injects"?

• Definition: Injects refer to pieces of malicious code inserted into legitimate websites, often without the owner's knowledge.
  • Attackers compromise sites (via software vulnerabilities or credential stuffing) and inject code.
  • The site appears normal to owners and users until the attack is triggered.
  • Quote:
    "So when I'm speaking of injects, I'm speaking of injected malicious code that was not intended to be there by the rightful owner of the website."
    — Andrew Northern (03:11)

Funneling Behavior Explained

• Attack Flow: Thousands of compromised sites (the "edge") route victims through intermediate redirectors/loaders, then to a small set of final payload delivery sites (the "choke points").
  • This funnel-like structure increases the campaign’s reach while concentrating the actual malicious infrastructure.
  • Quote:
    "Large numbers of these compromised or low value sites are wired to steer victims into a much smaller set of shared infrastructure."
    — Andrew Northern (05:00)

Importance of Choke Points

• Defensive Focus: With so many compromised sites, tracking each one individually is impractical.
  • By identifying the relatively few shared redirect points (choke points), defenders can more effectively leverage their detection and blocking resources.
  • Quote:
    "By focusing on these choke points...defenders are better positioned to use their tools to protect themselves, their users and their domains."
    — Andrew Northern (05:59)

Attack Chain Identification Methodology

Andrew Northern’s Five-Step Approach:

1. Find Seed Patterns: Use anomalies or incident reports to identify initial suspicious activity (e.g., fake CAPTCHA templates, characteristic script names).
2. Scale Search: Use content matching (exact and fuzzy) against large datasets to identify likely malicious sites.
3. Graph the Attack Chain: Map out relationships between injected code, the next redirect, and shared resources.
4. Locate Choke Points: Identify where large numbers of infected sites lead to a small set of key redirectors/loaders.
5. Manual Validation: Simulate the attack as an end user to confirm chains lead to the intended final payload.
   • Quote:
     "I'll go ahead and hunt based upon the choke points...make sure that while I'm walking those chains manually...I am ultimately reaching those payloads."
     — Andrew Northern (09:38)

Patterns and Trends Across Campaigns

• Shared Techniques: Even among different actor groups, techniques are copied and in vogue methods propagate rapidly.
• Injection Evolution: Attackers have shifted from obvious scripts in main page headers to embedding payloads in auxiliary JavaScript libraries loaded by the page (e.g., for slideshows or forms).
  • Quote:
    "Threat actors were very predictably moving to the same JavaScript library over and over again and putting the code in there that will rotate over time."
    — Andrew Northern (11:31)

Monitoring and Defensive Recommendations

• Know Your Baseline: Defenders must understand normal behavior on endpoints to detect anomalies.
• Windows Policy Example: Associate .js files with a text editor instead of the Windows Script Host to prevent accidental execution by users.
  • Quote:
    "Have it associate with something that would make it benign, like a notepad or text editor. So if someone is lured into...downloading a payload...it would not infect the system..."
    — Andrew Northern (14:49)

Trends: Increasing Prevalence and Innovation

• Growing Use: Web-based inject attacks are more common than ever, with threat actors shifting from binaries to web-based lures.
• Popular Lures:

  • Fake CAPTCHA: Users conditioned to solve CAPTCHAs are tricked into actions that execute payloads (paste commands, etc.).

  • Fake Updates: Fake browser/software update prompts exploit users’ security training to deliver malware.

  • Quotes:
    "The biggest one that I've been seeing over the past year or so is a fake captcha...The threat actors are preying upon our conditioning..."
    — Andrew Northern (16:33)

    "Traditionally...a fake update...telling you that a critical piece of software on your computer is out of date."
    — Andrew Northern (17:43)

Where Is the Threat Heading?

• Persistence and Sophistication: Attacks are evolving, with techniques like "Ether hiding" incorporating blockchain smart contracts to store payloads/redirects, making takedown nearly impossible.
  • Quote:
    "They're now using part of the blockchain as well...that ledger has objects on it called smart contracts...that can be called from the HTML and JavaScript to read the contents...it's really hard to take these types of things down."
    — Andrew Northern (19:13)

Threat Actor Sophistication

• Dual Landscape:
  • Apex Predators: Highly skilled, rapidly innovating threat actors lead the charge, often motivated by financial gain or selling access.
  • Copycats: Widespread availability of AI tools like ChatGPT has lowered the bar, leading to an influx of new, less-skilled actors.
  • Impact: The increased volume and similarity in attack methods muddies attribution efforts for researchers.
  • Quote:
    "The barrier to entry...has greatly been lowered. So now we're seeing a lot of copycats...it also muddies the water for researchers who are trying to track and do attribution..."
    — Andrew Northern (21:48)

---

Memorable Quotes and Timestamps

• On funneling attacks:
  "Those choke points are important because...the number of infected or injected sites...is astronomical. There are at any given time...tens of thousands of these compromised sites." — Andrew Northern (05:59)

• On attacker adaptation:
  "I've seen threat actor groups that were using traditional means...pivoted to start...using these web based attacks." — Andrew Northern (15:57)

• On fake CAPTCHA lures:
  "Threat actors are preying upon our conditioning to interact with these captchas...commands right on our clipboard." — Andrew Northern (16:35)

• On the future threat:
  "I don't think that they're going to be going anywhere. And the difficulty for defenders in tracking and reproducing these steps is becoming more difficult..." — Andrew Northern (20:09)

---

Important Timestamps

• 02:08 — Shift towards web-based attacks
• 03:11 — Definition of injects
• 05:00 — Explaining funneling and choke points
• 06:58 — Tracing attack chains (five-step method)
• 14:22 — Defensive recommendations
• 15:57 — Prevalence and attacker adaptation
• 16:33 — Fake CAPTCHA lure technique
• 19:13 — The "Ether hiding" blockchain-based technique
• 21:09 — Threat actor sophistication, AI’s role in proliferation

---

Conclusion

Takeaways:
Web-based inject attacks are growing in prevalence and sophistication, exploiting both technological vulnerabilities and human behavior. Focusing on choke points within the attack funnel can be an effective mitigation strategy. The future points toward more persistent and evasive campaigns, especially as threat actors increasingly leverage innovative technologies like blockchain and AI tools.

Guest: Andrew Northern’s research provides essential insights for defenders, highlighting both technical detection strategies and the importance of understanding user behavior and baseline system operations.

---

For further detail: See the full research report: From Evasion to Exploiting the Funneling Behavior of Injects by Censys.

---

Transcript

[A]

You're listening to the Cyberwire Network powered by N2K. Security works best in layers and when those layers actually work together, that's when things get interesting. NORD layer is a network security platform designed for modern teams. It secures connections, controls access and helps stop threats, all without hardware or long deployment cycles. Now Nord Nordlayer has partnered with CrowdStrike to bring Falcon endpoint protection into the mix, giving small and mid sized businesses a multi layered security approach that's practical to deploy and easy to manage. Nordlayer handles secure access and zero trust networking. CrowdStrike Falcon adds endpoint visibility and protection. Together they cover more ground than either could alone without requiring a large IT staff. For business leaders, that means clearer control and easier compliance. For IT teams, IT means granular access policies, faster onboarding and protection that scales. If you're looking for enterprise grade security without enterprise grade complexity, take a look at Nordlayer. Get up to 22% off yearly plans plus an additional 10% with code CYBERWIRE10. There's even a 14 day money back guarantee. Check out nordlayer.com cyberwire daily to learn more. Hello everyone and welcome to the Cyberwires Research Saturday. I'm Dave Bittner and this is our weekly conversation with researchers and analysts tracking down the threats and vulnerabilities, solving some of the hard problems, and protecting ourselves in our rapidly evolving cyberspace. Thanks for joining us.

[B]

I think that in general what we're seeing is a broader shift in the greater threat landscape where we're seeing adoption of web technologies as the way that threat actors are choosing to deliver both lures and payloads as opposed to traditional means of perhaps delivering static payloads through traditional avenues such as email.

[A]

That's Andrew Northern, principal security researcher at Census. The research we're discussing today is titled From Evasion to Exploiting the Funneling Behavior of Injects.

[B]

And because of that, it affords a lot of great opportunities to really get in and explore what it is that threat actors are doing differently and how things are changing.

[A]

Well, help us understand in simple terms what exactly injects are.

[B]

Certainly so what we have is we have a series of websites, and by series I mean a great volume of websites. These are going to be anything from commercial websites to mom and pop brand personal blogs or any type of web website at all. And those particular web properties or websites are going to have vulnerable pieces of software on them that allow threat actors to take control or at a bare minimum, modify them. And in other cases what we're seeing is that from password stealing attacks from stealers in previous incidents, large numbers of usernames and passwords, and otherwise known as credentials are used in what are known as a password stuffing attack against some of these portals that are used for managing these sites, at which time then the threat actors are able to insert or inject, hence the name, a piece of malicious code onto those sites. So when I'm speaking of injects, I'm speaking of injected malicious code that was not intended to be there by the rightful owner of the website.

[A]

And so the website itself is functioning normally to the owner of the website and to the users of the website? Presumably?

[B]

Yes, that's correct. The exception to that is when the injects are meeting their desired purpose. And that's when you'll start to see some anomalies pop up which are the beginning of the attack chain.

[A]

Well, you talk about this funneling behavior of inject based attacks. Can you explain that for us?

[B]

Yeah, for sure. When I speak about funneling, what I mean is I'm talking about the way that large numbers of these compromised or low value sites are wired to steer victims into a much smaller set of shared infrastructure. And you'll see the same patterns tend to emerge. So those are going to be many different injected pages, domains and templates that we can consider to be the edge. And then moving down the ATTCK chain, we see a relatively smaller number of intermediary redirectors and JavaScript loaders in the middle. And ultimately funneling and getting tighter once again, we see even a smaller set of final payload delivery or decision points at the end.

[A]

The research describes what you call choke points in that second stage there. Why are these choke points important?

[B]

Yeah, so those choke points are important because the pure magnitude of this issue, the number of infected or injected sites, compromised sites, whichever you prefer to refer them to, is astronomical. There are at any given time, I would say with a moderate level of confidence, tens of thousands of these compromised sites. And as a defender, that is particularly difficult to try to get your arms around to proactively block those sites or at a bare minimum, monitor. So instead, by focusing on these choke points being at the small end of the funneling, as I described earlier, defenders are better able and better positioned to use their tools at their disposal to protect themselves, their users and their domains.

[A]

And how do you go about identifying and tracing these attack chains, especially at the scale that you're describing?

[B]

Sure. So the way that I go about it is what I would consider to be a five step process. The first thing I'm looking for is a seed or seed patterns. And that's by looking at anomalies that I've either discovered on my own or that I am ingesting from incident reports, meaning small pieces of things that I can go off of and hunt on. These would be things like fake captcha templates, common script names and paths, or characteristic HTML fragments like JavaScript that are performing unusual redirects. So the seed patterns are the first step. Secondly, then I'm using censuses, index HTML bodies, and various other resources to search for those patterns at scale. So that's going to include doing things like exact matching for known patterns, or fuzzy matching on script paths, query strings, or observed HTML snippets. So looking at that content similarity, then I'm able to narrow the field down into what I presume to be suspect or potentially malicious sites. After I do that, then I begin to essentially build out a graph of these properties of these hits. And so what I'll look at is I'll look at where the injected code lives, and then I'll look at what the next jump is in that ATTCK chain, meaning where does that malicious injected JavaScript redirect people to? And then I'll also look to see if I'm missing any shared resources. And what I mean by that would be the same pathing, such as suspect names, reusable names like captcha, js, or maybe something as basic as a letter like an A, JS or djs, which I've seen recently. So the third piece again is going to be trying to assemble a picture of that to fully understand exactly what this looks like. And then fourth, I'm going to identify what those choke points are. So once that graph or that picture that I just described is built, what I'm going to be doing is I'm going to be looking at what are the things that this large number of injected or infected sites have in common and where do they lead to? And that's where I'm able to identify that choke point. Once I identify that choke point, then I'm able to validate my hypothesis or assumptions and many times challenge them to make sure that I'm getting true positives there. And once I'm able to do that, then I'll move on to the fifth step, which would be to validate manually and reconstruct those attack chains. And so what I'll do is I'll go ahead and hunt based upon the choke points, pull out a number of random samples, and then I will make sure that while I'm walking those chains manually, as if I were the intended victim that I am ultimately reaching those payloads. So that way I understand how we lead from those initial lures to what can be presumed to be the intended final payload of the threat actor.

[A]

Do you find any consistency among the signals or the patterns that you find across these campaigns?

[B]

Yes. So what I find is that despite being what I would assess with a moderate level of confidence evidence to be unique or threat clusters, maybe even operated by distinct threat actors, there's a lot of sharing or copying of these techniques. And once you see what is essentially in vogue for, you know, this week or this month, then you start to see those types of things show up in various different clusters. Things like that would be a few years ago. As I've been tracking these types of things for a few years now, I saw threat actors stop injecting the JavaScript directly onto the main landing page. Generally it was the header where it was easy to find and identify, but then they moved on to putting it into other resources. These are going to be resources that are loaded by the page at the time of visiting. For example, if you want to have something like a slideshow or a particular form on your web page, you'll have a JavaScript library that's located on the same server that will be used in order to enable that functionality. What I saw was threat actors were very predictably moving to the same JavaScript library over and over again and putting the code in there that will rotate over time. But those are some of the similarities that I'm able to track across these various different clusters.

[A]

We'll be right back. Most security conferences talk about Zero Trust. Zero Trust World puts you inside this is a hands on cybersecurity event designed for practitioners who want real skills, not just theory. You'll take part in live hacking labs where you'll attack real environments, see how modern threats actually work, and learn how to stop them before they turn into incidents. But Zero Trust World is more than labs. You'll also experience expert LED sessions, practical case studies, and technical deep dives focused on real world implementation. Whether you're blue team, red team, or responsible for securing an entire organization, the content is built to be immediately useful. You'll earn CPE credits, connect with peers across the industry and leave with strategies you can put into action right away. Join us March 4th through the 6th in Orlando, Florida. Register now at ztw.com and take your zero trust strategy from Theory to execution. When it comes to mobile application security, good enough is a risk. A recent Survey shows that 72% of organizations reported at least one mobile application security incident last year and 92% of responders reported threat levels have increased in the past two years. Guard Square delivers the highest level of security for your mobile apps without compromising performance, time to market or user experience. Discover how Guard Square provides industry leading security for your Android and iOS apps at www.guardsquare.com. Well, from a defender standpoint, what does the research suggest about where they should be focusing their monitoring and their detection efforts?

[B]

Yeah, that's a very good point. As far as the monitoring and detection goes, I think that it comes back to understanding the baseline of your environment, meaning that if there are things that are out of the norm that are happening on your endpoints that don't align with what is established behavior, that's certainly worth raising the alarm on. But more specifically, defenders can implement certain policies on their networks. If we're talking about Windows networks, a administrator would be able to implement a group policy object or a gpo, which is a rule set that applies to the computers that are joined to the domain to associate something like a JS or JavaScript file, not to open with the default WScript utility built into Windows, which would evaluate and execute that JavaScript payload, but rather have it associate with something that would make it benign, like a notepad or text editor. So if someone is lured into clicking on one of these things or visiting one of these malicious sites and is lured into downloading a payload when they go to open it, it would not infect the system but rather just show them a show them the script which would effectively break the chain.

[A]

Now you mentioned that you've been looking at these things for a number of years. What's the trend that you're tracking? Are these becoming more or less common? Where do we stand?

[B]

I can tell you that the adoption is higher than it's ever been. I've seen what I track threat actor groups that were using traditional means of delivering malware, meaning pre built binaries or payloads that have hard coded command and control configurations baked into them. Those threat actors have pivoted to start starting to use these web based attacks. I can give you a few examples of some of the lures that have become popular as well as some of the new techniques and technologies that I'm seeing. If that's all right with you?

[A]

Yeah, please.

[B]

So I'll start with some of the lures. The biggest one that I've been seeing over the past year or so is a fake captcha, and what that is is essentially when you are Visiting a website. There are a number of anti bot technologies that we've been accustomed to running into as a legitimate user. For example, if we go to visit a site and the site says, hey, maybe there's been some anomalous traffic coming from this ip, or maybe there's just a whole lot of traffic right now where you need to make sure that people aren't bots, you may be served up a captcha. And because of this technology that is used to protect websites, us as humans and end users, we've been conditioned to start to click on these captchas. So the threat actors are preying upon our conditioning to interact with these captchas. And once that is we've interacted with them, then the threat actors are using JavaScript to place a set of malicious commands right on our clipboard. And then some follow on instructions are displayed such as to prove that you're a human, please do this keystroke. And it depends on if you're on Windows or Mac, but ultimately it culminates to opening some type of command prompt or terminal and pasting in the command which will download the payload and execute it. Those are called click fix and the lure type is fake captcha. Traditionally, what we've seen in the past is a fake update. And that is going to be something that is telling you that a critical piece of software on your computer is out of date. And this is particularly frustrating as a defender because we've worked so hard to get our end users to be, let's say, judicious and to want to accept updates on their endpoints to keep them safe from vulnerabilities. So when you're presented with a page that says your Chrome or Firefox or whatever web browser you're using is out of date and needs to be updated in order to continue. The same type of security awareness training that has been provided is the same type of thing that conditions end users into following those directions that are provided by the threat actors.

[A]

So where do you suppose we're headed with this then? I mean, it seems as though this threat is here to stay. Is this destined to be an ongoing nuisance and problem in your estimation?

[B]

I fear it is, because even as we speak, I'm seeing additional changes to these attack chains that are leveraging new pieces of technology. For example, I've written what can be considered a follow up article to this report, to this funneling report that we're discussing about a technique called Ether hiding. And Ether hiding is a an attack chain that uses the same type of injections and technology and techniques that we've been talking about already, but they are now using part of the blockchain as well. The blockchain being the external transparent ledger that's generally associated with cryptocurrency and various things of that nature. That ledger has objects on it called smart contracts, which are binary objects that can be called from the HTML and JavaScript to read the contents of these smart contracts, which cannot be updated without transparency. Meaning that it's really hard to take these types of things down. As opposed to traditional websites where one could file a complaint when they discover what the C2 or the payload delivery infrastructure looks like, the JavaScript is then pulling the payload and in some cases the next steps in a redirect chain to yet another resource. So to fully answer your question, I don't think that they're going to be going anywhere. And the difficulty for defenders in tracking and reproducing these steps is becoming more difficult, and that lends itself to continued adoption and sustained use by threat actors.

[A]

How do you rate the sophistication of these threat actors?

[B]

I have two thoughts on that. First, we tend to see what I would call the visionaries in this space, which are highly capable, what I would consider to be the apex predators of the threat actor landscape, specifically the E crime or the criminal landscape, whose motivations are stealing money and getting that initial access, and then perhaps executing a locking of a domain, such as a ransomware that we've seen in the news, or maybe even just getting that foothold and selling it to another group that would like to conduct that activity. Those folks, I would say, are some of the most capable developers that I've seen. And the way that these threats continue to evolve rapidly, it will make your head spin. Just the efficacy and the quickness in which they're able to deploy new tricks to evade researchers and defenders. The other side of that is that with the advent of AI, especially tools like chat, GPT and Claude and various other LLMs, the barrier to entry in order to make these types of tools and attacks has greatly been lowered. So now we're seeing a lot of copycats. And so this does a couple of things. Number one, it increases the amount of attacks like this that are on the Internet. But it also muddies the water for researchers who are trying to track and do attribution of threat actors. Because when you see folks that are adopting similar techniques and, and many who I would consider to be unskilled are able to get working tools generated by these AI programs, then it really is a duality of folks who really know what they're doing and those who don't know much but are able to get a working attack chain going.

[A]

Our thanks to Andrew Northern from Census for joining us. The research is titled From Evasion to Exploiting the Funneling Behavior of Injects. We'll have a link in the Show Notes and that's Research Saturday brought to you by N2K CyberWire. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast. Please also fill out the survey in the Show Notes or send an email to cyberwire2k.com this episode is produced by Liz Stokes. We're mixed by Elliot Peltzman and Trey Hester. Our executive producer is Jennifer Ibin. Peter Kilpe is our publisher. I'm Dave Bittner. Thanks for listening. We'll see you back here next time. If you only attend one cybersecurity conference this year, make it RSAC 2026. It's happening March 23rd through the 26th in San Francisco, bringing together the global security community for four days of exper expert insights, hands on learning and real innovation. I'll say this plainly, I never miss this conference. The ideas and conversations stay with me all year. Join thousands of practitioners and leaders tackling today's toughest challenges and shaping what comes next. Register [e-mail] cyberwire26 I'll see you in San Francisco.

[B]

Well, the holidays have come and gone once again, but if you've forgotten to get that special someone in your life a gift, well, Mint Mobile is extending their holiday offer of half off unlimited wireless.

[A]

So here's the idea. You get it now.

[B]

You call it an early present for next year.

[A]

What do you have to lose? Give it a [e-mail] Switch limited time 50% off regular price for new customers. Upfront payment required $45 for three months, $90 for six month or $180 for 12 month plan taxes and fees. Extra speeds may slow after 50 gigabytes per month when network is busy. See terms. Attackers don't go through your tools, they go around them. In our interview with Jared Atkinson, CTO at SpectreOps, he reveals how attackers look to exploit our identities, steal tokens, and quietly snowball their access across active directory, cloud apps and GitHub. We talk through attack paths. Why least privilege keeps failing and how one misconfiguration can hand over the keys to your organization. Want to see risk as attackers do? Then check out the full interview now on TheCyberWire.com Spectrops.