When the COVID-19 virus is spreading in China, people take the initiative to isolate themselves at home to fight the virus. Internet application traffic has soared, and most people pass their time through apps such as Tiktok. The attackers targeted the home gateway, used 0day to attack more than 3 million home gateway IoT devices, and used HTTP hijacking to insert advertising pages when users browsed the web. This topic will briefly introduce the principle of the vulnerability, focus on the malware used by the attackers and their functions, and reproduce the techniques used by the attackers to insert advertisements in web pages.