Ethical Hacking News
A seemingly innocuous pixel from Taboola has been found to be quietly redirecting logged-in banking sessions to a tracking endpoint hosted by Temu. This unprecedented incident highlights the risks of unregulated third-party tracking and the need for more robust security measures in place.
A vulnerable pixel from Taboola was found to redirect logged-in banking sessions to a tracking endpoint hosted by Temu.The vulnerability lies in how the pixel interacts with content security policies (CSPs) and web application firewalls (WAFs), which fail to account for runtime destination of requests.Taboola's redirect chain includes headers that instruct browsers to include cookies in cross-origin requests, allowing Temu to access tracking identifiers stored on user browsers.The incident highlights the need for security teams to inspect runtime behavior and legal and privacy teams to take a more rigorous approach to browser-level tracking chains on authenticated pages.Users must remain vigilant about security measures they implement and ensure robust content security policies are regularly reviewed and updated.
The recent discovery by Reflectiz, a European financial platform, has shed light on a shocking vulnerability in the online advertising industry. A seemingly innocuous pixel from Taboola, a well-known content recommendation platform, was found to be quietly redirecting logged-in banking sessions to a tracking endpoint hosted by Temu, an e-commerce platform. This unprecedented incident highlights the risks of unregulated third-party tracking and the need for more robust security measures in place.
In order to understand the scope of this issue, it's essential to delve into the technical details behind Taboola's pixel. The pixel is essentially a small piece of code that is embedded on websites, allowing advertisers to track user behavior and demographics. While this may seem like a harmless practice, the problem lies in how this pixel interacts with content security policies (CSPs) and web application firewalls (WAFs).
Most security stacks, including WAFs, static analyzers, and standard CSPs, rely on the declared origin of a script to evaluate its legitimacy. However, this approach is fundamentally flawed, as it fails to account for the runtime destination of a request chain. In other words, these systems only inspect the declared origin of a script but do not verify the actual endpoint that the request is routed to.
In the case of Taboola's pixel, the redirect chain executes as follows:
1. Initial Request: A GET request is sent from a user's browser to sync.taboola.com.
2. Redirect: The server responds with a 302 Found, redirecting the browser to https://www.temu.com/api/adx/cm/pixel-taboola?...
3. Payload: The redirect includes critical headers such as Access-Control-Allow-Credentials: true.
This header instructs the browser to include cookies in the cross-origin request to Temu's domain. This is precisely how Temu can access and manipulate tracking identifiers stored on a user's browser, even if the user has logged into their banking session.
The implications of this discovery are far-reaching. For regulated entities, such as banks, the absence of direct credential theft does not limit compliance exposure. Users were never informed that their banking session behavior would be associated with a tracking profile held by PDD Holdings – a clear transparency failure under GDPR Art. 13. Furthermore, the routing itself involves infrastructure in non-adequate countries, and without standard contractual clauses covering this specific fourth-party relationship, the transfer is unsupported under GDPR Chapter V.
This highlights the need for security teams to inspect runtime behavior, not just declared vendor lists. Legal and privacy teams must also take a more rigorous approach when it comes to browser-level tracking chains on authenticated pages. As The Hacker News notes, "The threat entered through the front door. Your CSP let it in."
In response to this alarming incident, Reflectiz has released a Security Intelligence Brief that provides a detailed breakdown of the technical evidence surrounding Taboola's tracking pixel. The report is available for download.
To avoid falling victim to similar incidents in the future, users must remain vigilant about the security measures they implement on their devices and networks. A robust content security policy (CSP) can help mitigate this risk, but it is essential to ensure that these policies are regularly reviewed and updated to account for new threats.
In conclusion, the recent discovery of Taboola's tracking pixel has served as a stark reminder of the risks associated with third-party tracking in online advertising. It highlights the need for greater transparency, more robust security measures, and a renewed focus on inspecting runtime behavior, rather than relying solely on declared vendor lists.
Related Information:
https://www.ethicalhackingnews.com/articles/A-Hidden-Passenger-The-Unseen-Threat-of-Taboolas-Tracking-Pixel-ehn.shtml
https://thehackernews.com/2026/04/hidden-passenger-how-taboola-routes.html
https://www.reflectiz.com/learning-hub/taboola-temu-redirect-report/
https://www.socinvestigation.com/comprehensive-list-of-apt-threat-groups-motives-and-attack-methods/
https://www.reflectiz.com/
https://breach-hq.com/threat-actors
https://www.techradar.com/pro/security/temu-says-it-wasn-t-breached-after-hacker-supposedly-leaks-87-million-strong-database
https://onerep.com/blog/temu-data-breach-what-actually-happened
Published: Thu Apr 16 08:33:01 2026 by llama3.2 3B Q4_K_M
