Browser Hijacking Software on CNN Election Site is Reason for Concern by@andrejc
371 reads

Browser Hijacking Software on CNN Election Site is Reason for Concern

tldt arrow
Read on Terminal Reader

Too Long; Didn't Read

A spammy ad appeared on, redirecting readers to a download page for a malicious browser extension. Browser hijackers can log keystrokes and provide a channel for malware; worst of all, they can be used to spread misinformation and manipulate voters.

Companies Mentioned

Mention Thumbnail
Mention Thumbnail
featured image - Browser Hijacking Software on CNN Election Site is Reason for Concern
Andrej HackerNoon profile picture



Andrej Černý: CS student from Czechoslovakia. I study the intersection...

About @andrejc
react to story with heart

About two months ago, I was enjoying some well-needed downtime and preparing for a weekend trip to Big Bend when something interesting happened. I first noticed it while I was on wikiHow, figuring out how to fix a problem with my bike. While there, I noticed a spammy ad that looked familiar - that's when I realized I'd seen it the night before on a local weather site.

I decided to do a little digging: it's not the first time I've looked into spammy, malicious ads. But this one seemed to be following me around across different destinations - somewhere along the way, a cookie must have been dropped on my device, and it was persistent. While that's not unusual behavior, what I discovered on further investigation was more disturbing.

A Browser Hijacker on

After cycling through some of my recent destinations to see where else the ad would appear, I found it replicated across a few different sites, including Bleacher Report (go Cowboys) and TVLine. But most surprisingly, it also showed up on the CNN 2022 election site where I'd been tracking the midterms earlier that week.


That's when I knew I had to figure out where this ad wanted to take me and what it was ding on a public news site. After clicking, the ad directs to a download page for a browser extension. This was red flag number one: browser hijackers like ChromeLoader are becoming a serious problem - they can modify browser settings without user permission, download software, and track them across the Web over time.

Red flag number two: the software this ad wanted me to download had already been flagged as risky by multiple sites, as I determined with a trusty Google search. Strangely enough, none of the vendors on VirusTotal flagged the program as malware despite the fact that it clearly was. To me this suggests a pretty recent malvertising campaign.

A Threat to Election Integrity

As someone who spends time researching Web security, I wanted to do a deeper dive - unfortunately I didn't get a chance before the ad stopped showing up for me. But the fact that it appeared at all - and appeared on a site many Americans depend on for reliable information about upcoming elections - is concerning to me.

Browser hijackers are capable of all kinds of malicious activity - they might log keystrokes and they might provide a channel for ransomware attacks. Worst of all, they might be used to show misinformation based on a user's voting preferences to manipulate their decisions and beliefs.

In previous election seasons, malicious actors used recommended content and targeted advertising to spread propaganda – they used those same mechanisms to promote fake health products during the COVID pandemic – and the U.S Cyber Command is afraid they will try to interfere with the 2022 Midterms. Here’s an article about it from CNN (be careful).

A Call to News Sites

The 2022 election season in the U.S is coming in hot – with geopolitical tensions rising, nation state actors have every incentive to target voters in any way they can. Even if that weren’t the case, Internet users should be able to depend on trusted sites like CNN not to serve them spammy advertisements that link to dangerous malware.

While many websites are impacted by this problem, media and news companies should be leading the way in scanning their web pages for this kind of content and removing the parties who put it there. I would say it’s part of their basic responsibility to non-paying readers and subscribers alike – what about you?

Andrej HackerNoon profile picture
by Andrej @andrejc.Andrej Černý: CS student from Czechoslovakia. I study the intersection between malware and media.
Read My Stories


. . . comments & more!
Hackernoon hq - po box 2206, edwards, colorado 81632, usa