Our team invests countless hours in the exploration, discovery and investigation of emerging trends such as AI and futuristic technology. Stay informed about the evolving landscape of cyberthreats through our diligent efforts and insights.

Security Evangelist at Gen

Senior Malware Researcher

Research

Cybercriminals continue to refine their methods, and our latest discovery ties together multiple advanced attack techniques into a single campaign which demonstrates the latest trend in “Scam-Yourself” attacks. This particular campaign utilizes fully AI-generated videos created using deepfake principles and AI-generated scripts, created with ChatGPT and hosted on Pasteco and other script sharing websites. In our&nbsp;<a href="https://www.gendigital.com/blog/insights/reports/threat-report-q3-2024">Q3/2024 Threat Report</a>, we reported a 614% surge from “Scam-Yourself” attacks, those which&nbsp;manipulate people into voluntarily downloading malware or compromising their own security. Shortly after, we announced our&nbsp;<a href="https://www.gendigital.com/blog/news/family-of-brands/clipboard-protection">Clipboard Protection</a> feature, adding an extra security layer against these attacks. In a matter of days, we uncovered&nbsp;<a href="https://www.gendigital.com/blog/insights/research/cybercriminals-leveraging-chatgpt-to-create-malicious-payloads">cybercriminals actively leveraging ChatGPT to create and refine malicious payloads</a>. This article sheds light on the latest evolution of these tactics.What makes this discovery even more significant is the revelation that the campaign originates from a well-crafted video hosted on a verified YouTube channel with 110,000 subscribers. The channel appears to have been either compromised or acquired, and the video has already amassed +24,000 views. Additionally, numerous YouTube accounts, all variations of the same AI-generated profile, have been used to amplify the scheme, accumulating hundreds of thousands of subscribers.

<h2>The Dangerous Convergence of Threats</h2>This campaign connects multiple security challenges:<ul><li>Compromised accounts: The attack likely started with data theft using information stealers, allowing cybercriminals to take control of a verified YouTube channel and repurpose it for their scam operations. The channel, at first glance, appears legitimate as it includes a list of videos from the official TradingView channel, making it seem trustworthy. However, it also contains an unlisted deepfake video, which can be shared externally. This deception makes it difficult for victims to identify the fraud when viewing the channel. Furthermore, numerous fake accounts have been created, misusing this person as the “face” of multiple fraudulent channels. These fake YouTube accounts using the AI persona of Thomas Harris / Thomas Roberts have hundreds of thousands of subscribers. Many appear to be taken over or bought-off old accounts, some dating back to 2011. These accounts are continuously being taken down. Additionally, the engagement on these channels is manipulated, with all positive comments typically being 'bought' and added in bulk within a short period. Some of the observed fake accounts include @ThomasHarris-Iives, @thomas_hrris_a, @Thomas_View, @Thomas_Harris_Us, @ThomasRoberts_crypto, @tiommewweb3, @Thomas_Now, @RudoAMIN, and @UC6QvVs237am4RyYo1vGHF3g.</li></ul>

<ul><li>Deceptive tutorial video: The video presents itself as a tutorial to unlock TradingView’s developer mode, claiming that doing so will provide AI-powered indicators to help users grow their portfolio by a significant percentage. This lure is designed to appeal to individuals looking for an easy way to maximize their financial gains, making them more susceptible to following the video's malicious instructions.</li></ul>

<ul><li>Deepfake technology: The video appears to depict a completely AI-generated person, with no identifiable real-world counterpart. It utilizes techniques similar to those used in deepfake creation, combining voice, facial synthesis, and body movement replication to create a highly convincing impersonation. Furthermore, we’ve observed more AI-generated videos used across the fake profiles, suggesting attackers are re-creating multiple versions of this well-crafted content.</li><li>AI-generated malicious scripts: The script used in the attack was created with AI, in this particular case with ChatGPT. The script itself remains largely unchanged across different variations of the campaign, with the only significant difference being the Command-and-Control (C&amp;C) address. Attackers modify the C&amp;C domain as previous ones are flagged or blocked, demonstrating an adaptive approach to evade detections.</li><li>Scam-Yourself trend: The video demonstrates the same tactics seen in past attacks, instructing users to manually execute harmful commands (e.g., pressing Win+R and entering specific code).</li><li>Hosting services: Attackers have shifted from pasteco[.]com to equivalent sites such as 0bin[.]net or pastefy[.]com, and likely attacker-controlled domains such as pasteco[.]net and pasteco[.]io, a strategy designed in an attempt to evade detection.</li><li>Remote access and data theft: The end goal of this campaign is to install NetSupport or Lumma Stealer, granting attackers full control over the infected system and enabling data exfiltration. Cryptocurrency serves merely as a lure to attract an audience motivated by easy profit.&nbsp;</li></ul><h2>Malvertising as the origin</h2>Especially when we consider that some of the videos are unlisted and on verified accounts, one might ask how the user comes across such a video in the first place. What we can see is quite a big promotion via Sponsored advertising on YouTube, allowing the videos to pop-up while watching other videos with similar type of content, for example cryptocurrency related investments or other financial opportunities.

In this case, the account was named Oscar Davies, leading to slightly different variant of the AI generated video. This indicates that the attackers don’t hesitate to re-generate the original video to refresh the content and stay undetected for a longer period of time. When following the advertisement, the video is, in this case, also verified with the checkmark. We can see that the account has nearly half a million subscribers, with the video having 12 thousand views and the time of the analysis. Interestingly, these numbers do not match with the advertised views.

We observed multiple different thumbnails and video titles for the advertised videos, too, likely provided by additional AI driven image generation.

<h2>How We Are Protecting Users</h2>Our security solutions detect and block this threat. Our&nbsp;<a href="https://www.gendigital.com/blog/news/family-of-brands/clipboard-protection">Clipboard Protection</a> feature, designed to prevent clipboard-based scams, is particularly relevant in mitigating such attacks. This campaign reinforces the growing importance of proactive security measures against evolving social engineering threats.We remain committed to tracking these threats and investigating similar campaigns as they evolve. With deepfakes, AI-generated malware, and social engineering tactics advancing rapidly, proactive security measures are more crucial than ever. Given the involvement of a major player in this space, Lumma Stealer, it is likely that we will see even more campaigns following a similar model. This trend could lead to the creation of even more sophisticated AI-generated personas, making it increasingly difficult to distinguish real from fake. As cybercriminals refine their techniques, vigilance and robust security measures will be essential in combating these evolving threats. Stay safe and always verify sources before executing any online instructions.<h2>Indicators of Compromise (IoCs)</h2>902387e7be025fbe2c4b1a3f2ea212a26f9cbbcf82f656416b362c84089b712b (PowerShell commandline)a5e0635363bbb5d22d5ffc32d9738665942abdd89d2e6bd1784d6a60ac521797 (PowerShell script)developer-update[.]dev (C&amp;C)1b5b3e104f80e09f006a1080fefae16fed2dbf1abb697e464cbef3f2fabc5d90 (PowerShell commandline)begenokev[.]com/oauth/harum/voluptas (C&amp;C)2fe60aa1db2cf7a1dc2b3629b4bbc843c703146f212e7495f4dc7745b3c5c59e (Lumma Stealer)developerbeta[.]dev (C&amp;C)b89aa5a2837aa09d0caae2bc5be130186f236471411b279049dd1cfce6a5643f (PowerShell commandline)bcbb6de248a95bfdbf4cfe8db8d84f8a10db2896f27cb90058c69b7bb052d506 (PowerShell script)

Inside the Evolution of AI-Powered Scam Tactics

How AI-Generated Personas, Deepfake Tactics and Scripts Are Powering the Next Wave of"Scam-Yourself" Attacks

Threat Analysis Engineer at Gen

Threat Researcher at Gen

Imagine receiving a message on LinkedIn from a recruiter offering an enticing opportunity: a well-paid front-end development project that seems almost too good to be true. It’s a scenario many aspiring programmers dream of, especially those eager to land their first job in the tech industry. However, as this story reveals, the dream can quickly turn into a cybersecurity nightmare.&nbsp;<h2>The Setup&nbsp;</h2>The attack begins innocuously enough. A recruiter reaches out on LinkedIn, pitching an appealing development project with an impressive salary. The target? Entry-level front-end developers, often beginners in the field and eager to seize opportunities. Once the victim expresses interest, the recruiter provides a link to a code repository, ostensibly containing the project files.&nbsp;In one known case, the recruiter’s high salary offer raised suspicions. This wariness led the targeted individual to scrutinize the repository, revealing malware embedded within the code. The victim wisely decided against proceeding, avoiding infection entirely. Shortly thereafter, the recruiter’s LinkedIn profile disappeared, leaving questions about their next steps unanswered.&nbsp;<h2>A Firsthand Example&nbsp;</h2>This story came to light when we became aware of a similar job offer on LinkedIn. The recruiter claimed to be developing a decentralized application (DApp) for purchasing and claiming ownership of video games using NFTs. The project aimed to provide a seamless cross-platform experience and was allegedly seeking skilled web developers to help with their UI/UX redesign.&nbsp;

After a few messages, the recruiter shared a Bitbucket repository link. At first glance, the project appeared legitimate, with standard documentation and architecture diagrams detailing the NFT-based system. However, deeper investigation revealed a suspicious obfuscated JavaScript file, onfig-overrides.js, containing malicious code. This file, overlooked by an untrained eye, was designed to:&nbsp;<ul><li>Steal login credentials</li><li>Exfiltrate crypto wallet data</li><li>Deploy and execute a Python loader&nbsp;</li></ul>The recruiter’s polished approach and seemingly genuine project made the scam particularly deceptive.&nbsp;

<h2>The Mechanism&nbsp;</h2>The attack exploits standard industry practices. In many coding interviews or preparation tasks, candidates are asked to clone a repository, run a local server, and work on the application offline. This is commonplace for front-end developers testing web applications. However, in this case, the repository included concealed malware designed to compromise the developer’s system.&nbsp;<h2>The Step-by-Step Anatomy of the Attack&nbsp;</h2>Once executed, the obfuscated JavaScript file initiated a multi-stage attack process, consisting of two main phases: the initial JavaScript execution and the subsequent Python-based payloads.&nbsp;Phase 1: JavaScript Execution&nbsp;<ol><li>Information Stealing: The initial script acted as an infostealer, targeting:</li></ol><ul><li>Solana wallet configurations and stored crypto wallet data.</li><li>Login credentials stored in web browsers such as Firefox and Chrome.</li><li>Other sensitive information that could be used for further attacks.</li></ul><ol start="2"><li>Python Loader Deployment: The JavaScript file downloaded and executed a Python-based loader, which was responsible for delivering the next set of malicious payloads.&nbsp;</li></ol>Phase 2: Python-Based Payloads&nbsp;<ol start="3"><li>Remote Access Trojan (RAT): The Python loader executed a RAT with keylogging and advanced spying capabilities, including:</li></ol><ul><li>Remote shell commands: Enabling attackers to execute commands on the victim’s machine.</li><li>Clipboard exfiltration: Capturing and transmitting clipboard data to the attacker.</li><li>Payload downloads: Downloading and executing additional malicious files.</li><li>Browser process termination: Killing Chrome and Brave browser processes to disrupt user activity.</li><li>Sensitive file exfiltration: Searching for and exfiltrating critical files such as .env, readme, and .git.</li></ul><ol start="4"><li>XMRig Cryptominer: As part of the second Python stage, the XMRig cryptominer was deployed, exploiting the victim’s computing resources to mine cryptocurrency, which resulted in degraded system performance and increased power consumption.&nbsp;</li></ol>This structured attack exemplifies the multi-layered and highly intrusive nature of this attack, ilustrating how it moves beyond simple credential theft to fully compromising the victim’s machine.&nbsp;<h2>The Lazarus Group Connection?&nbsp;</h2>Interestingly, the tools used in this attack, named "BeaverTail" and "InvisibleFerret," have been attributed to the notorious Lazarus group in the past. We have strong indications that the attack was orchestrated by the Lazarus group, given their history of sophisticated cyber campaigns and their association with the tools used. The attackers leveraged tools previously linked to high-profile cybercrime, making it critical to approach such situations with caution. While the involvement of Lazarus cannot be confirmed with absolute certainty, the evidence strongly suggests their involvement.&nbsp;<h2>The Broader Implications&nbsp;</h2>While this specific attack focused on credential theft and cryptojacking, the Remote Access Trojan (RAT) also allows attackers to maintain long-term control over infected systems. This could be used for espionage, further malware deployment, or data exfiltration. Additionally, the potential harm could extend far beyond. The perpetrators could use such schemes to:&nbsp;<ul><li>Compromise company systems through stolen credentials, allowing further infiltration and unauthorized access.</li><li>Utilize the compromised system for ransomware deployment or additional malware infections.</li><li>Leverage the infected machine as a launching point for future cyberattacks, amplifying the scope of the breach.&nbsp;</li></ul>The idea of attackers genuinely hiring developers to create malicious tools is not far-fetched, though it seems unlikely in this instance.&nbsp;<h2>Lessons for Job Seekers&nbsp;</h2>This incident serves as a crucial reminder for job seekers, particularly those new to the field, to exercise vigilance when assessing job offers. Here are some tips to protect yourself:&nbsp;<ol><li>Have an online interview before proceeding: Before starting any test or downloading files, request a video call with the recruiter to verify their legitimacy and discuss the job offer in detail.</li><li>Verify the recruiter’s credentials: Cross-check their profile and company information. If something seems off, trust your instincts.</li><li>Scrutinize repositories: Before cloning or running any code, scan the files for anomalies. Use reputable security tools to analyze suspicious files.</li><li>Question too-good-to-be-true offers: Unrealistically high salaries or overly eager recruiters can be red flags.</li><li>Use sandbox environments: Run unfamiliar code in isolated environments to prevent potential infections.</li><li>Stay informed: Keep up with the latest cybersecurity threats to recognize warning signs early.&nbsp;</li></ol><h2>Conclusion&nbsp;</h2>Threat actors are increasingly targeting individuals with highly personalized and sophisticated methods, exploiting both technical vulnerabilities and human psychology. This case serves as a sobering reminder of the lengths cybercriminals will go to exploit human trust and technological processes. For aspiring developers and job seekers, awareness and skepticism are critical defenses. As we face increasingly sophisticated threats, a collective effort to educate and inform will play a crucial role in minimizing risks. By staying vigilant, leveraging security tools, and promoting best practices, we can create a safer digital landscape for everyone—one where opportunities are genuine, and trust is protected.&nbsp;

Beware of Fake Job Offers: How Hackers Are Targeting Developers with Malware

How Cybercriminals Are Turning Job Offers Into Malware Traps 

<h2>Clipboard Protection Reveals ChatGPT’s Role in Malware Attacks&nbsp;&nbsp;</h2>Attackers are constantly seeking innovative ways to deliver malicious payloads – harmful malware components. Our Norton, Avast and AVG brands recently launched Clipboard Protection, and the feature has uncovered an intriguing new development. &nbsp;Through Clipboard Protection, which analyzes content copied from websites in Firefox and Chrome, we identified a sophisticated attack chain involving a Remote Access Trojan (RAT) known as NetSupport RAT. This discovery highlights how attackers are exploiting AI tools like ChatGPT to create and iteratively improve malicious scripts, further enhancing their effectiveness.&nbsp;<h2>From AI to Malware: The ChatGPT Connection&nbsp;</h2>In a recent investigation, we discovered the development process of a malicious script in three distinct stages. The first two iterations were clearly drafts obtained from ChatGPT. AI-generated content’s ability to rapidly generate, adjust and polish technical scripts makes it a double-edged sword. While tools like ChatGPT offer benefits for applications, they also enable malicious actors to streamline the development of harmful payloads.The final version of the script, a polished malicious script, was later copied by unsuspecting users from legitimate content-sharing websites. The script poses as a prompt to "Enable dev-mode for TradingView," urging users to run terminal commands that ultimately install malware on their systems. This tactic leverages the trust and interest in popular platforms like TradingView to manipulate users into unwittingly executing harmful code.&nbsp;<h2>The Stage of the Malicious Script&nbsp;</h2>By analyzing the clipboard data, we were able to trace the evolution of the malicious script:&nbsp;<ol><li>Initial Drafts: Generated via ChatGPT, providing a basic framework for the attack.&nbsp;</li><li>Refinement: Adjustments made by the attackers to improve the script’s functionality and conceal malicious intent.&nbsp;</li><li>Final Version: A seamless, deceptive script disseminated on legitimate platforms, primed for unsuspecting users to execute.&nbsp;</li></ol>

Clipboard Protection’s ability to track these stages showcases the role of real-time analysis in identifying and reducing emerging threats.&nbsp;<h2>Clipboard Protection: A Game Changer&nbsp;</h2>This discovery underscores the importance of proactive features like our in an ever-evolving threat landscape. Cybercriminals are continuously adapting, finding new ways to bypass defenses and deliver their malicious payloads. Our Clipboard Protection feature was designed to analyze content copied from websites in real time, alerting users to potential threats like <a href="https://us.norton.com/blog/emerging-threats/threat-report-q3-2024" target="_blank" rel="noreferrer noopener">ClickFix and FakeCaptcha</a> attacks. By staying ahead of attackers with innovative solutions like this, we not only detect and prevent attacks but also gather valuable insights into emerging tactics, enabling us to anticipate and counter new threats effectively.&nbsp;As cybercriminals continue to adapt their tactics, relying on sophisticated tools like AI to refine and distribute malicious payloads, solutions like Clipboard Protection play a pivotal role in staying ahead of these threats. Tracking the evolution of attacks and intercepting them before they can cause harm can ensure protection for users and systems in this complex digital landscape.&nbsp;&nbsp;<h2>Indicators of Compromise (IoCs)&nbsp;</h2>SHA256&nbsp;46114741a409cdc05b10152cd469dd724dd44e1e61155ab47de26799c96d298f&nbsp;25dbd7505d600dbe024f5491a61c9a1ee16b81c151f7e8fd633d7144fe045106&nbsp;cd341e404f40bd826e4e3b5a60db28161a70a29a9fb360c74884c6254b0031a8&nbsp;URL&nbsp;https://pasteco[.]com/t2yc80yb&nbsp;

How ChatGPT Is Aiding Cybercriminals in Crafting Advanced Malware Scripts

Cybercriminals Actively Leveraging ChatGPT To Create And Refine Malicious Payloads

<h2>Key points:&nbsp;</h2><ul><li>Glove Stealer is an information stealer written in .NET, stealing sensitive data from wide range of browser extensions as well as locally installed software&nbsp;</li><li>It focuses on browser data (cookies, autofill, …), cryptocurrency wallets, 2FA authenticators, password managers, email clients, and more&nbsp;</li><li>Glove Stealer uses a dedicated supporting module to bypass App-Bound encryption by using IElevator service&nbsp;</li><li>While observed being spread via phishing emails resembling ClickFix, it itself also tries to mimic a fixing tool which users might use during troubleshooting problems they might have encountered&nbsp;</li></ul><h2>Introduction&nbsp;</h2>We’ve been closely observing various social engineering tactics, such as ClickFix and FakeCaptcha, for quite some time now. Tactics like these deceive users into thinking they are helping themselves, but by following the instructions from the attackers, they are actually inadvertently infecting their own devices. The steps the users are led to take commonly involve copying a malicious script that’s typically copied on background without user noticing. The instructions then prompt the user to paste and execute it via a PowerShell terminal or a Run prompt on Windows, displayed by a Win+R key combination.&nbsp;In a recent campaign using traditional phishing emails, we observed these scripts to distribute an interesting information stealer written in .NET, which we’ve named Glove.&nbsp;The stealer is relatively simple and contains minimal obfuscation or protection mechanisms, indicating it might still be in an early development phase. However, it uses a recent method to bypass App-Bound Encryption which was <a href="https://security.googleblog.com/2024/07/improving-security-of-chrome-cookies-on.html" target="_blank" rel="noreferrer noopener">introduced by Google</a> in Chrome 127. This bypass method involves using an IElevator service and was publicly <a href="https://github.com/xaitax/Chrome-App-Bound-Encryption-Decryption" target="_blank" rel="noreferrer noopener">disclosed by Alexander Hagenah</a> on Oct. 27, 2024.&nbsp;Other than stealing private data from browsers, it also tries to exfiltrate sensitive information from a list of 280 browser extensions and more than 80 locally installed applications. These extensions and applications typically involve cryptocurrency wallets, 2FA authenticators, password managers, email clients and others.&nbsp;<h2>Technical analysis&nbsp;</h2><h3>Distribution&nbsp;</h3>Even though ClickFix can take many forms, including inserting the crafted fake error messages into compromised websites or attacker-hosted pages, this campaign started with a user receiving a phishing email. Along with the e-mail, typically an attachment is present in HTML format. An HTML page like this contains typical ClickFix motives, showing a crafted fake error message stating that some content couldn’t be accessed properly, then advising the user how to fix it. By following the instructions, the user copies a malicious script to their clipboard and, after executing it in a terminal or the Run prompt, they unintentionally infect their own system. Below is an example of such an HTML page displayed when the user opens the attachment.&nbsp;

Under the hood, the script copied and executed by the user invokes a PowerShell command encoded by Base64. However, as is common in these campaigns, it’s followed by a couple of consecutive intermediary scripts.&nbsp;

After going through additional intermediary scripts, we get to a point where the script is calling and displaying an additional message to the user:&nbsp;

Following the messaging of the OneDrive example above, it attempts to appear as it should, as if it is fixing the DNS configuration. However, this is false, as there is no issue to begin with—the problem was artificially introduced to the user. The malicious script is contacting the attacker’s C&amp;C server to obtain Glove Stealer, ultimately leading the user’s device to become infected.&nbsp;In this specific case, the script downloads the Glove Stealer from this address below:&nbsp;https://master.volt-texs[.]online/api/c4slhp3l&nbsp;The payload is downloaded from the server as a text from the HTML page, and an analyst’s eye can immediately recognize the beginning of a PE file, just Base64 encoded.&nbsp;

<h2>Putting the gloves on to bypass and steal&nbsp;</h2>Naturally, this payload gets decoded and executed. Upon execution, Glove Stealer follows the whole narrative of ClickFix once again by displaying a terminal window with a text “Wait Search problems…”.&nbsp;

Along with the authors likely lacking some English skills, the “o” in the word “problems” is also a homoglyph, which is a character that looks the same (or almost identical) to an original one, yet with a different binary representation. However, this might not get properly interpreted in some terminal or environment configurations, as can be seen in our testing environment below.&nbsp;

The malware then pings another C&amp;C server, using a randomly generated string (a limited set of upper-cased letters and numbers) in the path, with the ID set to 0 to indicate it was successfully executed on the victim’s infected device:&nbsp;https://master.hdsjfkgsadoghdsiougds[.]space/mother/RANDOM_STRING?id=0&nbsp;This address is used multiple times during the malware execution to indicate successfully passing certain stages and submitting other data, such as encryption keys. For example, with an ID set to 1, it indicates that the initial malware configuration is set properly on the device.&nbsp;Before the data exfiltration takes place, Glove Stealer terminates any (browser) processes which contain any of the substrings mentioned below in the process name:&nbsp;<ul><li>chrome&nbsp;</li><li>yandex&nbsp;</li><li>browser&nbsp;</li><li>msedge&nbsp;</li><li>opera&nbsp;</li><li>brave&nbsp;</li><li>chromium&nbsp;</li><li>CryptoTab&nbsp;</li></ul>This is also being done in an infinite loop every 55 milliseconds and the malware steals data from other browsers, like Firefox.&nbsp;<h2>The exfiltration and data structure&nbsp;</h2>Glove Stealer parses and stores the information obtained from browsers into dedicated text files stored in the following directory structure:&nbsp;<ul><li>\AllPws.txt&nbsp;</li><li>\INFS.txt&nbsp;</li><li>\Cookies\&nbsp;</li><li>\Autofill\&nbsp;</li><li>\Restore\&nbsp;</li><li>\OTP\&nbsp;</li><li>\Wallets\&nbsp;</li></ul>All folders and files used to store the stolen data are prefixed with a path that represents a directory that contains the user's most recently used documents (via Environment.SpecialFolder.Recent), followed by an MD5 hash of from the combination of computer’s name and a SerialNumber of the device’s disk drive.&nbsp;The files stored in the folders which contain the stolen data from browser are labeled with the browser name and a possible postfix. For example, in case of cookies, this postfix would be the name of the exfiltrated browser profile (Default, Profile 1, Profile 2, …). As an example, the location and the name for Chrome cookies could be stored as follows:&nbsp;%APPDATA%\Microsoft\Windows\Recent\MD5_HASH\Cookies\Chrome_Default.txt&nbsp;The file INFS.txt contains a fingerprint of the device, including details like the OS, computer and username, maximum available RAM, language, CPU information and more. The remaining files stored in the dedicated directories don’t deviate from the used folder names and file names mentioned above.&nbsp;The cookies, wallets and other possible data are not obtained just from the browsers, but Glove Stealer is using vast lists of predefined locally installed applications and browser extensions, then tries to search for these and exfiltrate valuable data from them. Since the lists are too exhaustive to mention in the text (84 defined locations for the locally installed apps and 280 browser extensions), an interested reader can find these on our <a href="https://github.com/avast/ioc/tree/master/GloveStealer" target="_blank" rel="noreferrer noopener">GitHub. </a>To name here at least part of the scope, the Glove Stealer focuses on:&nbsp;<ul><li>Vast variety of cryptocurrency wallet browser extensions&nbsp;</li><li>2FA authenticators, including Google Authenticator, Microsoft, Aegis and LastPass, to name a few&nbsp;</li><li>Password managers, including Bitwarden, LastPass and KeePass, to name a few&nbsp;</li><li>Email clients like Thunderbird&nbsp;</li><li>Gaming platforms like Steam and Battle.net&nbsp;</li></ul>Data in which the stealer is interested in can be represented by searching for this list (not exhaustive) of files and locations for each of the app:&nbsp;<ul><li>\Network\Cookies&nbsp;</li><li>\Login Data&nbsp;</li><li>\Web Data&nbsp;</li><li>\Local Extension Settings&nbsp;</li><li>\Sync Extension Settings&nbsp;</li><li>\Local State&nbsp;</li><li>\LocalPrefs.json&nbsp;</li></ul>After the stealer is finished with data harvesting, the entire directory structure is then packed using FileZip and encrypted by 3DES in ECB mode and sent to a C&amp;C server. The key for the 3DES cipher is generated on the fly as a string value represented by DateTime.Now.Ticks string hashed using MD5.&nbsp;The ZIP file, representing the exfiltration package, is stored in the Recent directory with the name of MD5_HASH.xexe (the hash is still the computer’s name + SerialNumber). Immediately after it is encrypted using 3DES, it is renamed to MD5_HASHXE, where XE is an appended substring.&nbsp;To be able to decrypt the package, the attackers are sending this key in parameters using the ping C&amp;C server once again. For this, the ID parameter is set to 2 and the MD5 hash used as 3DES key immediately follows:&nbsp;https://master.hdsjfkgsadoghdsiougds[.]space/mother/RANDOM_STRING?id=2&amp;ids=MD5_key&nbsp;However, the exfiltrated package is sent to the other C&amp;C server as a POST request, with the data encoded by Base64:&nbsp;https://master.volt-texs[.]online/index2.php&nbsp;For the attackers to stay safe from losing the key, they also back-up the 3DES key here as well, using the non-hashed timestamp in the POST request.&nbsp;<h2>Supporting module for App-Bound encryption bypass&nbsp;</h2>In order to use the stolen data from Chrome, Glove Stealer needs to bypass the App-Bound encryption. To do this, it requests the original server once again to retrieve a .NET payload to do the job.&nbsp;This payload is a supporting module, which is rather small, and it is dedicated to bypassing the App-Bound encryption using IElevator service.&nbsp;https://master.volt-texs[.]online/postovoy/RANDOM_STRING&nbsp;Named as zagent.exe, this payload is downloaded and Base64-decoded into Chrome’s Program Files directory: %PROGRAMFILES%\Google\Chrome\Application\zagent.exe&nbsp;After execution, the module is using a hardcoded "app_bound_encrypted_key":" string for searching and retrieving the App-Bound encryption key stored in the local state file: %LOCALAPPDATA%\Google\Chrome\User Data\Local State&nbsp;&nbsp;

After the key is retrieved, it is Base64-decoded and stored in a dedicated file called chromekey.txt so it can be also accessed by Glove Stealer itself. After that, the C&amp;C server is pinged to indicate the bypass was successful (ID=4).&nbsp;Note that, since App-Bound encryption also performs a path validation for the location of the caller processes, this supporting module must be placed in the Chrome’s Program Files directory tree. As a result, Glove Stealer needs to acquire local admin privileges first to use this supporting module.&nbsp;<h2>Conclusion&nbsp;</h2>In this analysis, we described Glove Stealer, an information stealer observed in recent phishing campaigns that leverage social engineering tactics, such as ClickFix. In these tactics, the attackers aim to trick users into thinking they are helping themselves, when in reality, they are inadvertently infecting their devices by following the instructions provided by the attackers.&nbsp;Glove Stealer is capable of stealing various kind of information from many browsers, including Chrome, Firefox, Edge, Brave and others. To achieve this, Glove Stealer uses a dedicated supporting module that leverages IElevator service to bypass App-Bound encryption. Additionally, it steals sensitive data from two extensive lists: one representing locally installed applications and the other representing browser extensions. These include cryptocurrency wallets extensions, 2FA authenticators, password managers, email clients and more.&nbsp;<h3>Indicators of Compromise (IoCs)&nbsp;</h3>For more detailed list of IoCs, including the lists of locally installed apps and browser extensions, please visit our <a href="https://github.com/avast/ioc/tree/master/GloveStealer" target="_blank" rel="noreferrer noopener">GitHub</a>.&nbsp;Original script copied in clipboard:&nbsp; 2bf6fab237ab58ae6cfe78f9a61ab6dcaf55f437cb7a77878e2e6aae3b208e80&nbsp;Glove Stealer&nbsp;56da496329d54587c31119d8878a7831a9814a92839aa6a9873ceeb91575b11a&nbsp;Supporting module for App-Bound encryption bypass:&nbsp;86ad4082e086a0b9a22dc91a16d0d9be38232975ab4d3d035224fb6d6cc7a44c&nbsp;C&amp;C&nbsp;master.hdsjfkgsadoghdsiougds[.]space&nbsp;master.volt-texs[.]online&nbsp;

A .NET malware, bypasses Chrome's App-Bound Encryption, stealing data from browsers, crypto wallets, 2FA authenticators

Glove Stealer: Leveraging IElevator to Bypass App-Bound Encryption & Steal Sensitive Data

Imagine you are enjoying your weekend when you suddenly get a notification. You check it out, and it turns out it’s from Skype—yes, that old software you didn’t even remember you had installed. You open it up and find that someone has added you to a group called “Options Trading-86,” and you’re in there with 500 other people.&nbsp;

At first glance, it seems harmless—maybe even intriguing. The group claims to be a space for learning how to make money trading Bitcoin, led by an "analyst" from ARK Investment Management, no less. But as you scroll through the messages, things start to feel a little off.&nbsp;<h3>The Pitch: Free Advice from a "Professional"&nbsp;</h3>The first message comes from someone claiming to be Yassine Elmandjra, a real analyst from ARK Investment, welcoming everyone to this "charity class" on Bitcoin trading. They introduce Probit, a cryptocurrency exchange, and promise daily guidance on how to grow your wealth through Bitcoin contracts. The tone is friendly, and the offer of "free" advice sounds like a great deal.&nbsp;But here’s the thing—when was the last time a legitimate financial analyst offered free, daily trading tips to random people on Skype?&nbsp;

<h3>Building Trust Through Familiar Names&nbsp;</h3>This is where the scam starts to take shape. Scammers often borrow the names of trusted companies or individuals to build credibility. ARK Investment Management and Yassine Elmandjra are real, reputable entities, but their names have been hijacked here to create an illusion of legitimacy.&nbsp;

As you scroll further, you notice people chiming in about how much money they’ve made from following the advice. The group is lively, with people expressing gratitude for their daily profits and praising Elmandjra's accuracy. But are these people even real?&nbsp;<h3>The Emotional Hook: Get Rich Together&nbsp;</h3>Then the emotional manipulation kicks in. Participants share stories of how the pandemic affected their finances and how Bitcoin trading has given them a second chance. Others talk about securing their family's future or how this trading opportunity has changed their lives.&nbsp;

This is a classic scam tactic—use emotional appeals to lower your defenses. They want you to believe that by joining in, you too can turn things around and secure financial freedom. After all, if everyone else is making money, why shouldn’t you?&nbsp;<h3>The "Opportunity" Unfolds&nbsp;</h3>As you stay in the group, the real offer becomes clear. The group offers two investment options:&nbsp;<ol><li>Pay 20% of your profits as a commission.&nbsp;</li><li>A "guaranteed" 100% profit if you give them 50% of the earnings as commission, with the promise that any losses will be compensated by the investment advisor.&nbsp;</li></ol>Let’s stop here for a second. Guaranteed profits? Covered losses? In any real investment scenario, these promises would set off alarm bells. No legitimate financial advisor can guarantee profits, especially in the volatile world of cryptocurrency.&nbsp;<h3>Pressure to Invest Big&nbsp;</h3>The group doesn't waste time encouraging you to invest substantial amounts. They provide a handy guide on how much to start with, based on how much USDT (a cryptocurrency pegged to the US dollar) you have: $3,000, $6,000, or even $15,000.&nbsp;The message is clear: the more you invest, the more you can supposedly earn. But what’s really happening is the scammer trying to get as much money from you as possible before disappearing.&nbsp;<h3>The Push for Action&nbsp;</h3>Throughout the chat, there's constant pressure to act now. “If you want to learn more, sign up for a Probit account,” they say. The assistant, Lilian, is always available to help, promising easy registration and seamless trading. If you’re on the fence, testimonials from other group members provide glowing reviews of how easy and profitable it all is.&nbsp;Of course, none of this is real. The real goal is to get you to sign up for a fake account, give away personal information, and invest your money into an account you don’t control.&nbsp;<h3>What Happens Next?&nbsp;</h3>Once they’ve gained your trust and your money, the scammers will vanish. The group will likely continue to look active for a while, with bots or fake accounts continuing to post messages of success, but eventually, the entire operation will disappear, leaving you with empty pockets.&nbsp;<h3>Red Flags to Watch For&nbsp;</h3><ul><li>Unsolicited Group Invitations: Being added to a group out of nowhere is a huge red flag.&nbsp;</li><li>Impersonating Trusted Companies: Scammers often use the names of real, reputable entities to build credibility.&nbsp;</li><li>Promises of Guaranteed Profits: No legitimate financial advisor guarantees profits, especially in the world of cryptocurrency.&nbsp;</li><li>Emotional Manipulation: Scammers play on emotions, hoping you’ll be too focused on the promise of easy money to recognize the risks.&nbsp;</li><li>Pushing One Specific Platform: The heavy push to use Probit (or any single platform) should raise suspicion.&nbsp;</li></ul><h3>How to Protect Yourself&nbsp;</h3><ol><li>Always Be Skeptical of Unsolicited Offers: Whether it's a random group invite or a message from someone you don’t know, always question why you’re being contacted.&nbsp;</li><li>Verify the Source: Do your own research on the company or individual. In this case, contacting ARK Investment would reveal that they have no connection to this group.&nbsp;</li><li>Don’t Share Personal Information: Be cautious about sharing any personal or financial details with people or platforms you don’t trust.&nbsp;</li><li>Do Your Research: Always investigate the platforms being promoted. A quick online search might reveal whether others have reported it as a scam.&nbsp;</li></ol><h3>Final Thoughts&nbsp;</h3>This case illustrates just how far scammers are willing to go to exploit the growing interest in cryptocurrency. By creating a false sense of security, urgency, and community, they convince people to part with their money.&nbsp;Nowadays most of the threats we protect of are scams, more than virus, trojans or worms. Make sure you have a good security solution installed. Another good way to protect yourself is to stay informed. If something feels off or sounds too good to be true, it probably is. Be cautious, do your research, and never make decisions based on pressure or emotion.&nbsp;

A Cautionary Tale of Digital Deception

How a Skype notification turned into a costly lesson 

Malware Researcher at Gen

Researchers from Avast have discovered a flaw in the cryptographic schema of the Mallox ransomware variant that was prevalent during 2023 and early in 2024. Victims of the ransomware may be able to restore their files for free if they were attacked by this particular Mallox variant. The crypto-flaw was fixed around March 2024, so it is no longer possible to decrypt data encrypted by the later versions of Mallox ransomware.&nbsp;<h2>Overview of the Mallox ransomware&nbsp;</h2>The Mallox ransomware was previously called TargetCompany ransomware, which Avast released a decryptor for in January of 2022. Since then, the cryptographic schema has been evolving – the original cryptographic flaw was fixed by the malicious actors in February 2022, resulting in the decryptor for TargetCompany no longer working. However, as the cryptographic schema kept evolving, the authors made new mistakes which allowed data decryption without having the private ECDH key.&nbsp;Based on our userbase telemetry, the following picture shows countries with the largest number of blocked attacks of the Mallox ransomware from Oct 2023 to Oct 2024:&nbsp;

The top 5 countries (based on number of blocked attacks) are:&nbsp;

<h3>Leak Site&nbsp;</h3>Mallox thread actor also has an <a href="https://x.com/___Mallox___" target="_blank" rel="noreferrer noopener">account on X</a>, but it has not been maintained since March 2023. Their leak site on the Dark Web shows the list of victims up to June 2024.&nbsp;

<h3>How to recognize the decryptable version of Mallox?&nbsp;</h3>The decryptable versions of Mallox were spreading from January of 2023 to about February 2024 (based on the compile time of the samples). Decryptable files can be recognized by the following extensions:&nbsp;<ul><li>.bitenc&nbsp;</li><li>.ma1x0&nbsp;</li><li>.mallab&nbsp;</li><li>.malox, .mallox, .mallox, .malloxx&nbsp;</li><li>.xollam&nbsp;</li></ul>During file encryption, Mallox ransomware leaves a ransom note in each folder. The possible file names are:&nbsp;<ul><li>FILE RECOVERY.txt&nbsp;</li><li>HOW TO BACK FILES.txt&nbsp;</li><li>HOW TO RESTORE FILES.txt&nbsp;</li></ul>The following pictures show the ransom note content:&nbsp;

<h3>How to use the Mallox ransomware decryptor</h3><ol><li>Download the decryptor <a href="https://files.avast.com/files/decryptor/avast_decryptor_mallox64.exe" target="_blank" rel="noreferrer noopener">here</a>. If you still use 32-bit Windows, you can also get the <a href="https://files.avast.com/files/decryptor/avast_decryptor_mallox64.exe" target="_blank" rel="noreferrer noopener">32-bit version of decryptor</a>.&nbsp;</li><li>Run the decryptor, preferably as an administrator. It starts as a wizard, leading you through the configuration of the decryption process. The decryptor must be executed on the same computer where the files were encrypted. &nbsp;</li></ol>

<ol start="3"><li>On the next page, the user is asked to provide a list of locations (drives, folders, files) that are to be decrypted. By default, the decryptor provides a list of all local disk drives.&nbsp;&nbsp;</li></ol>

On the final page, you can opt-in to back up your encrypted files. These backups may help if anything goes wrong during the decryption process. This option is selected by default, which we recommend. After clicking Decrypt, the decryption process begins. Let the decryptor work and wait until it finishes decrypting all of your files.

<h3>Indicators of Compromise (IOCs)</h3>The list of Mallox samples and extensions of encrypted files follow: &nbsp;a340ef5adb00a2bf1a0735600491ca98ac8045b57db892dedc27575a53b25056&nbsp;<ul><li>.bitenc&nbsp;</li></ul>&nbsp;003ea0712cd31a75f5dfb6a23d2d12ea1e615f7601574ade09b6b61e3b7ed2b0&nbsp;25719f4afa357af8141e42fa9a0499c08fd94011690b8e75e8a22ce6af31c825&nbsp;311d3c07ceabb08fd3f2486ad99fb6a7b2ea881135ef3f75840f9fd859fec537&nbsp;34c04dff26da88c339eeb1220f7e8ac8cfc47a340237c37edbae96c8fd1ee5e5&nbsp;6976ffaa2deac082dedcd30e2ecb2faa86e5361d1c22d6678baf44985ef217ce&nbsp;8bc92f4a5b1429397be96fe264a543752e92d73a4e7ed9fbdbb21e654c2cb838&nbsp;a2b63fae8c83a02f57fff4d932a1e846765a70b18bfae65c127f72010674cce8&nbsp;b87712413054cffeb98212babcea85c8f6f460e28269717c31e2e84bd4192d02&nbsp;dd871fe134be4b972c6e22efbb6c7d59d908127c3148ef1958c43ba5a33185ed&nbsp;<ul><li>.ma1x0&nbsp;</li></ul>&nbsp;0653d7a8a2267e6e7db5c8f39afca7f358ce097d7c0724c0c70493f6cf30f43d&nbsp;0706c9d8413a6ffb7dc68d6a69a9ced942ad2e9f3318a2cf2e535d44661b52a2&nbsp;1da63eb16aa6d7ec9e6d46f3897275bb238ac8156fcee3552bb3b41af73fee44&nbsp;311eac772bea66edba4c9f180d55776f0e8c40c64d6066de354ae68504f69a77&nbsp;3742b60308d2a7fb47c69a625dfdaae16561db5ee7353ce9a8a02110961192f5&nbsp;374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a&nbsp;3f044ba34bdf3c049e1f2468c91339ffc71d61fea913a43f876b8ba05211d0dc&nbsp;3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9&nbsp;4674370e64733f2f634251da6967fe96f02ac4654543b36b1b80e765495bfe4e&nbsp;5133aab38acbe99380dccf5f69150c887467a910cc3052b5054ffca56e149847&nbsp;(and 30 more)&nbsp;<ul><li>.mallab&nbsp;</li></ul>&nbsp;03596723ecb5be777b1e3ec5deb414dc78155a30a466b2b25a4574f4db9a568a&nbsp;0e37d23af67569980f74ee9fd76ffc03280ea79ea581cc00c8c5030049739e29&nbsp;116bcf7ff3927139f92fcafad0ee8105e90c6e11f57e913976d65b1d326874f6&nbsp;197e192e8c3a7df7a4e00a7c67d91bbf1cff1dbe756ec6e5e446f9a16df96ad8&nbsp;1bc30c4abebb326a548401b665540b5203591599220889907f316f5ebdf99dd5&nbsp;1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584&nbsp;1c8b6d5b79d7d909b7ee22cccf8f71c1bd8182eedfb9960c94776620e4543d13&nbsp;1d217728faecddc1699af6761a9dfb22fe0ed648abc47639017c3eac7cfa0f85&nbsp;1db038fea314da6884990e1ecdd5579ade64803db4d29384c9ac752cf44a354c&nbsp;1e7342641f88f9df8b7830544821531544585f30bea7fd895b7db8a0a461896b&nbsp;(and 74 more)&nbsp;<ul><li>.mallox&nbsp;</li></ul>&nbsp;0064cafe8474c7a29e514d16825cb2a2b804e64c3f0d7f660b3b3e76cb37d7cc&nbsp;1cf818229b7d06a4caf2c6bd4b3b3e8b2cc865ba7b77b7176f412ccb08e3f6d8&nbsp;55d568e14868cc4a2583db29688996bc43f8f27bfb8b3ddb95662f7f9deac4b4&nbsp;5abe151418fc18090eba2c62ffdefe738250151f34ea1b290f63df702f68deac&nbsp;7105930cb8859795303ebd254ad785faf13d6dacd41fda733a29f40e2c551fc6&nbsp;90672eb92326724cc125c276faa3c8bba7b837d0b9b13977c4c67330d7cfddae&nbsp;ce198296ebb3def9b1c929b3e54072e831e05d993eda48129987ef93d717a7d6&nbsp;df29d5c4a750663440ce76d6804ce88e03faeef9591ec0b3b9ca348a6c930b7f&nbsp;2044bc33cf855b4add30312da75ac8daa408197408da88ecd520d90bdef550ff&nbsp;3cd0e666eef8439064a78aa8d60669c9ec98edea60ec0894548bad6c97954970&nbsp;(and 8 more)&nbsp;<ul><li>.malloxx&nbsp;</li></ul>&nbsp;0427a9f68d2385f7d5ba9e9c8e5c7f1b6e829868ef0a8bc89b2f6dae2f2020c4&nbsp;0463277782f9e98b0e7a028cea0f689a81cf080fa0d64d4de8ef4803bb1bf03a&nbsp;19570b184cacd8288a3d0756eeff7568af9970afc2d63dce69101d5ece88dfb6&nbsp;21f33c588bba58522d5e475f43012a886d42be956c644cc000e87c59c4cf9008&nbsp;2b4ec26fc1c25f56e5469f3550815cf6e488eab6641fbf661464ec7170a66d93&nbsp;2fd3c8fab2cfaaabf53d6c50e515dd5d1ef6eceeebdd5509c23030c4d54cb014&nbsp;36079d6856ba2935e17401f80caa160195460e0afefc191b0fe04c31d2f9f4b6&nbsp;3ab42c1bd05fabaf3276a66f0a9f7d8a509aec4835b321d03b3165a71dd5924d&nbsp;66038da15ef19678b4a98531b045e3e7e924a8f1e508732054648fac77a5fd9f&nbsp;75498c3fa25bbbcdaa970d83376c4b8f6e5403980141125e9b05a389584cca8b&nbsp;(and 26 more)&nbsp;<ul><li>.malox&nbsp;</li></ul>&nbsp;86ec7e79b5eb6f22fc657203b8bc0da895f09045d3252030130eff0830018466&nbsp;bfcf5d57790f28dd78d5f351776e0fee4efd537e9490c3105d5c6bbf37e8b241&nbsp;<ul><li>.maloxx&nbsp;</li></ul>&nbsp;0598708adf2aabe3aa81919f50dc0fd65acf4d4ed80ad32dc43d09a3bab7b50a&nbsp;10f96f64659415e46c3f2f823bdb855aab42d0bfced811c9a3b72aea5f22d880&nbsp;258101f7b1767837217a242fee4e71896df06d758e97fe79d996224d67f7d136&nbsp;4ed74a205fad15c843174d7d8b30ae60a181e79f31cc30ebc683072f187e4cdd&nbsp;52e281f8cde1fd07b54aecbac93cc97890a3c59ff8bac5627b5dfbd7c07a4e48&nbsp;7f81d7b71fff4ab3abc82e1ccf83bf386bb1172b0978238ae3ff9ea912c4e7e3&nbsp;9acbc6b9342e22059c02db89c629d56b2ada8b56abe94f2a901ed1252beac2cd&nbsp;<ul><li>.xollam&nbsp;</li></ul>

Researchers uncover flaw in Mallox ransomware, offering free file recovery for early victims

Decrypted: Mallox ransomware 

Brand & Social Media Manager

In today’s digital age, where cybersecurity concerns touch every aspect of our lives — from personal privacy to global business operations — staying informed is crucial. As cyberthreats continue to evolve and cyberattacks persist, our analysis of the second quarter reveals key trends, insights and strategies to protect yourself and your organization.<h2>The Cyberthreat Landscape: What We Saw April - June 2024</h2>If you’re wondering how many cyberattacks are happening daily, here’s the sobering truth: our family of brands blocks over a billion cyberattacks every single month. Yes, a billion. The overwhelming majority (90%) of these attacks come from <a href="https://us.norton.com/blog/emerging-threats/what-is-social-engineering">social </a><a href="https://us.norton.com/blog/emerging-threats/what-is-social-engineering" target="_blank" title="What is social engineering?">engineering</a>, which targets human psychology rather than technical systems. The goal? Trick you into making mistakes that lead to data breaches. Even though the overall number of attacks slightly declined from April to June, cybercriminals are evolving faster than ever. Total threats were 46% higher than in 2023, and it’s clear that no one can afford to lower their guard.<h2>Social Engineering Attacks: How Scammers Trick You</h2>When it comes to cybersecurity threats, social engineering is public enemy number one. More than 90% of all cyberthreats in 2024 so far were driven by this method. Scammers prey on human nature, getting users to click on malicious links, share passwords or download malware. The most important line of defense? User education and cyber awareness training to recognize and avoid these traps before it’s too late.<h2>Web Browsing: The Riskiest Time Online</h2>Ever wondered when you’re most vulnerable to cyberattacks? The answer is simple: while browsing the web. A staggering 95% of attacks occur while you’re online, making <a href="https://us.norton.com/" target="_blank" title="Norton: real-time threat protection">real-time threat protection</a> a must-have. Although there was a small dip in threats from April to June, it’s no cause for celebration. The landscape is still dangerous, with scammers constantly adapting their methods to catch you off guard.<h2>Fake Antivirus Scams: Back and More Dangerous Than Ever</h2>You may think you’re too savvy to fall for a<a href="https://us.norton.com/blog/emerging-threats/fake-antivirus-scam" target="_blank" title="Antivirus scams"> fake antivirus scam</a> but think again. These scams are making a comeback, and they’re more convincing than ever. Scammers bypass typical security warnings to push fake virus alerts, tricking users into buying fake security software to ‘fix’ non-existent problems. Cybercriminals are banking on increased anxiety around cybersecurity threats, and they’re capitalizing on it.<h2>What Scams You Should Look Out For?&nbsp;</h2>Scammers are diversifying their attacks, targeting everyday people through multiple fronts. Some of the most common types of scams in Q2 2024 included:<ul><li>Job Scams: Promising lucrative <a href="https://www.gendigital.com/blog/news/innovation/part-time-job-scams" target="_blank" title="Part-time job scams">part-time jobs</a> or quick investments that sound too good to be true. These scams often lead to stolen money or personal information.</li><li>Online Dating Scams: Fraudsters create fake online profiles, build relationships with their victims, then ask for financial support or personal data.</li><li>Event-Related Scams: With big events like elections and concerts, scammers create fraudulent donation campaigns or phishing websites to steal your money and information.</li></ul><h2>The Rise of Identity Theft in 2024</h2>If you’re concerned about identity theft, you’re not alone. Threats targeting personal information are on the up and up, particularly through tools like information stealers (e.g., AgentTesla) and mobile banking trojans. These types of malware harvest sensitive data, whether from your desktop or your mobile device and then use it for fraud or theft.&nbsp;For 2024 and beyond, <a href="https://lifelock.norton.com/" target="_blank" title="Identity Theft Protection">protecting your personal information</a> should be a top priority.<h2>Ransomware Attacks Surge in 2024</h2>One of the most talked-about cybersecurity threats in 2024 is the rise in <a href="https://blog.avast.com/threat-report-q2-2024" title="ransomeware increase">ransomware attacks</a>. These attacks increased by 24% this quarter, with hotspots in the US, UK and India. Ransomware isn’t just about locking up your files anymore — criminals are using it to target businesses, government institutions and even individuals.We’ve released free decryption tools for ransomware victims (like those targeted by DoNex), and we’re actively working to disrupt the infrastructure behind ransomware attacks. If you’re concerned about ransomware, stay updated with the latest cybersecurity tools and software.<h2>Botnet Crackdown: Major Wins in Q2 2024</h2>One bright spot this quarter was the takedown of several botnets — networks of compromised computers used to launch massive attacks.<ul><li>Operation Endgame: Led by Europol, this operation targeted key botnet providers, leading to multiple arrests and significant setbacks for malicious operations. The impact of these botnets represents a big blow to cybercriminal networks.</li><li>U.S. Department of Justice Actions: The DOJ played a pivotal role in dismantling the notorious 911 S5 botnet. Additionally, actions against the DDoSia botnet led to several arrests, further disrupting the operations of these malicious entities.</li><li>Remote Access Trojans (RATs): Operations aimed at combating RATs, such as Hive, have yielded positive results. These efforts have effectively addressed threats that grant unauthorized access to systems, contributing to enhanced overall cybersecurity.</li></ul><h2>The Future of Cybersecurity: Innovation, Collaboration and Training</h2>Looking ahead, cybersecurity innovation will hinge on two things: advanced technologies like artificial intelligence (AI) and machine learning (ML), and collaboration between cybersecurity experts, policymakers and industry leaders. AI and ML allow us to detect and respond to threats faster, smarter and more efficiently. Combine that with skilled cybersecurity professionals and robust training programs, and we CAN and WILL stay ahead of evolving threats.<h3>A Future-Ready Approach to Cybersecurity</h3>As technology continues to advance, organizations must remain agile and forward-thinking. The second quarter of 2024 has shown us that the fight against cybercrime is relentless. But, at Gen, we’re doubling down on our commitment to protect digital freedom. From social engineering to ransomware, identity theft to botnets, we’re here to help you navigate these challenges and stay safe online. The future of cybersecurity isn’t just about defense; it’s about innovation, growth and creating a safer digital space for all.Explore more about the latest cybersecurity threats and how you can protect yourself. Read the <a href="https://www.gendigital.com/blog/news/innovation/q2-2024-threat-report" target="_blank" title="Q2 2024 Threat Report">full threat report here</a>.

Discover the latest cyberthreats — social engineering, ransomware and identity theft — and learn how to protect yourself

Q2 2024 Cybersecurity Trends: Rising Threats from Ransomware, Social Engineering and Identity Theft

The promise of easy money can often be too tempting to ignore, especially when it arrives via popular messaging platforms like WhatsApp and Telegram. Yet, lurking behind these seemingly benign job offers is a new, insidious form of scam that leverages social engineering to exploit the unwary. Victims are contacted under the premise of a part-time job offer with easy tasks that promises a steady income or a large payout. Once enrolled, the victims are put through a convincing social engineering scheme that in some cases pays victims with the intent of stealing large sums of money from them later.&nbsp;Victims, often in dire need of income, find these offers through unsolicited messages—red flags that are frequently ignored due to the pressing need for financial opportunities.&nbsp;

<h2>Understanding the Scam Dynamics&nbsp;</h2>Scammers are likely to message hundreds of thousands of people with a similar message. These can target job seekers or victims in need of money who may be more prone to falling for the scam. Once initial contact is established, the scammers will lure their victims with a job offer, which usually entails some form of product boosting on popular platforms such as eBay, Instagram, Youtube and others. This lends legitimacy to the fake job as the tasks are often conducted on the real platform.&nbsp;&nbsp;The mechanism of this scam is straightforward yet cunningly crafted. It begins with a flood of messages to potential victims, all promising easy earnings for simple tasks. These tasks vary widely but are common enough to not arouse suspicion, including:&nbsp;<ul><li>Adding products to shopping carts on sites like eBay and Amazon.&nbsp;</li><li>Following and interacting with accounts on Instagram or TikTok.&nbsp;</li><li>Watching and liking YouTube videos.&nbsp;</li><li>Writing reviews for hotels, restaurants, or entertainment on platforms like Google or Yelp.&nbsp;</li><li>Participating in online surveys or playing internet-based games.&nbsp;</li></ul>&nbsp;<h2>New Tactic: The Phone Call Approach&nbsp;</h2>A new way scammers initiate the process has recently emerged. Instead of blindly spamming via messaging platforms—which, while still useful, are increasingly recognized as fraudulent—scammers now use actual phone calls. These calls feature a natural feminine voice, most likely generated by AI, that tells the potential victim they have been selected to receive a $5 voucher as a user of TikTok. To claim it, the victim is instructed to add the calling number to their contacts and reach out via WhatsApp. Here’s a real example of the subsequent conversation:&nbsp;Scammer: Hello, my name is XXXXXX. Can I talk to you for 2-3 minutes?&nbsp;Victim: Yes, of course.&nbsp;Scammer: Thank you for your response. Our company works with TikTok merchants who are willing to pay to increase subscriptions and the visibility of bloggers. Therefore, our company needs to hire many coworkers to increase subscriptions for them on the TikTok app, and they will pay you.&nbsp;Scammer: We need many people to participate in the short video promotion bonus event and like TikTok content. Each video can earn you a reward of 3 euros, and you can earn a reward of 300-800 euros every day.&nbsp;Scammer: Are you interested in working with us?&nbsp;Victim: Yes, of course.&nbsp;Scammer: How old are you? Do you have a Telegram application?&nbsp;Victim: I am 28 years old and yes, I have Telegram.&nbsp;Scammer: Okay, very well. This is the easiest part-time job, just go to the link (TikTok), like the video, take a photo and send it to us.&nbsp;[Victim does the task and shows the screenshot]&nbsp;Scammer: Well done, I think you already know how we work. I will give you 3 TikTok video links as a test. You don’t need to watch the entire video, just like it and send me a screenshot, and you will earn 3€.&nbsp;Scammer: 3 TikTok Links&nbsp;&nbsp;Scammer: Copy the links to TikTok or click on the linked website to open it, like it and send me a screenshot.&nbsp;[Victim does the tasks and shows the screenshots]&nbsp;Scammer: Okay, I think you know how we work. Please add our business manager on Telegram:&nbsp;&nbsp;https://t.me/scammer_handle (link to scammer’s Telegram chat)&nbsp;Your employment code: XXXXXXX&nbsp;Scammer: Contact the recipient now, send him the code to fill out your details and you can earn 5€ for a total of 8€. Many people are in line to participate, please wait patiently, the receptionist will receive you. Please complete your information and submit it, after which you will receive a payment.&nbsp;&nbsp;<h2>The Turn to Advanced Fee Fraud&nbsp;</h2>After establishing trust, the scam takes a more sinister turn. Victims are invited to partake in 'VIP' tasks with the allure of higher earnings, which require an upfront investment with the promise of a significant return. Here, the psychology of commitment and consistency plays into the scammers' hands, trapping victims in a cycle of investment and expected returns.&nbsp;These VIP tasks are typically promoted in group chats, adding another layer of perceived authenticity through community involvement. Unfortunately, these groups often contain fake or bot accounts, all orchestrated to showcase a thriving, lucrative operation. When a victim pays the advanced fee, they might receive further small 'returns,' but as soon as they make a substantial deposit, the scammers typically vanish, leaving the victim with significant financial losses.&nbsp;&nbsp;<h2>Going undercover into the scammer trap&nbsp;</h2>We recently followed through on one such task scam, in this case the task consisted of adding products to our eBay shopping cart and sending screenshots to the scammers. There would be a list of tasks, each with their own urgency and potential rewards, generally in the $5-10 per task completed.&nbsp;&nbsp;

After completing a few tasks, the scammers will then deposit a small amount of USDT cryptocurrency into our wallet, as we could verify in our own account:&nbsp;

As we can see, the scammers may deposit real crypto currency into the victim’s wallet once they complete some of the easy starting tasks, with the intent of building trust and adding legitimacy to the scam. This may occur multiple times and the victim can withdraw the deposited money to their own bank account. This is all in build up to the main part of the scam, where the scam actors provide a ‘VIP’ or main task, urging the victim to pay an advance fee with a guaranteed return, usually in the 30-50% range.&nbsp;&nbsp;We were added to a larger group chat that featured the ‘VIP’ task, with numerous other users requesting the listed tasks and submitting proof of receiving commission transactions from the scammers. It is reasonable to assume that most of the accounts in the group are fake accounts or even bot accounts that are there to provide a sense of legitimacy, making the victim more likely to follow through on the advance fee scam.&nbsp;

As can be seen in the example above, there is a large variety in the amount that the victim may deposit. It is possible in the case of lower tiers of tasks that the scammers may again follow through and return the ‘invested’ money to the victim and add the commission, again, with the intent of building further trust. Once the victim selects a higher value option and deposits the money, the scammers will have achieved their goal and the victim’s money is already lost. The victim is highly invested into the scam, having sent, in some cases, thousands of dollars to the scammers. At this point, the bad actors will break contact or may make up reasons for why they cannot send the money and commission back, citing transaction fees, taxes or other made-up reasons. The intent here is to extract further money from the victim, usually with the added threat of losing the money if the victim does not follow through.&nbsp;&nbsp;A typical advance fee scam in essence, what is unique about this variety of scam is that often the scammers send real money to their victims to build trust. Unfortunately, it is highly likely that the money sent to victims is the already stolen money from previous victims, essentially creating a self-feeding scam cycle.&nbsp;&nbsp;&nbsp;<h2>The Impact and Scope&nbsp;</h2>According to recent data from the Federal Trade Commission (FTC), investment-related scams have seen a dramatic increase, with a reported 14% rise in losses amounting to over $10 billion in the U.S. alone in 2023 [<a href="https://www.ftc.gov/news-events/news/press-releases/2024/02/nationwide-fraud-losses-top-10-billion-2023-ftc-steps-efforts-protect-public" target="_blank" rel="noreferrer noopener">FTC</a>]. The personal stories shared on forums such as Reddit illustrate the devastating impact of these scams. Victims describe how they were duped into losing thousands of dollars after being lured by the promise of easy money for simple online tasks [<a href="https://www.reddit.com/r/Scams/comments/171dv4o/i_just_got_scammed_by_a_task_scam_and_i_feel/" target="_blank" rel="noreferrer noopener">Reddit Scam Example</a>].&nbsp;Global warnings have been issued, such as those by Singapore Police, highlighting the rise of job scams involving tasks on social media platforms [<a href="https://www.police.gov.sg/media-room/news/20240108_police_advisory_on_job_scam_involving_social_media_tasks" target="_blank" rel="noreferrer noopener">Singapore Police Advisory</a>]. We have detected this type of scams in several countries and languages, including Spanish, Czech and, of course, English. The good quality of the language used in those conversations makes us think they are using some AI-powered bot.&nbsp;&nbsp;<h2>Protection and Prevention Tips&nbsp;</h2>Below we provide a short summary of how to best identify and protect yourself from a task/job scam:&nbsp;&nbsp;<ul><li>Recognize the Red Flags: Unsolicited messages promising easy money should immediately raise suspicions. Legitimate job offers typically come through official channels and do not promise large sums for trivial tasks.&nbsp;</li><li>Verify Before You Trust: Take the time to research the company or offer. A legitimate business will have a digital footprint that extends beyond a single platform or message chain.&nbsp;</li><li>Understand the Role of Cryptocurrency: Cryptocurrencies, due to their irreversible transactions and anonymity, are favorites among scammers. Be extremely cautious when an offer involves cryptocurrency transactions.&nbsp;</li><li>Never Pay to Earn: Any job that requires you to pay upfront in order to start earning is almost certainly a scam. Real job offers do not require employees to give money to the company.&nbsp;</li><li>Use Available Resources: If you suspect you've encountered or fallen victim to a scam, report it to local authorities, the FTC, or cybersecurity firms like Avast that can offer support and resources.&nbsp;</li></ul>

Scammers Now Using Phone Calls to Initiate Fraudulent Schemes 

Part-Time Job Scams: A Growing Threat 

On Instagram or TikTok, it's common to receive follow requests from random people — even if your account is private. You might see requests from a few friends, someone you met years ago at a party or the occasional bot with zero posts and an irresistible offer. But how often do you get a request from one of the richest, most famous people on the planet?&nbsp;Well, guess what? I got one on TikTok!&nbsp;&nbsp;It wasn't just anyone—it was none other than Elon Musk himself!&nbsp;&nbsp;

I mean, look at that profile! The full name, the verified blue checkmark, and of course, the classic rocket emoji (classic Elon, right?). Sure, it looked like a fairly new account — 234 following, 0 followers — but hey, maybe this was Elon’s secret side hustle account, where he connects with regular people like me. Naturally, I accepted.&nbsp;It’s not every day that you get to say, “Elon Musk follows me on TikTok.” My friends will never believe this!&nbsp;I must admit, I was a little disappointed when I saw the follower count shot up to 2,468 as soon as I hit “Accept.” So much for being the first! I thought we had something special, Elon! But all that faded away the moment I got a message from him — the real Elon Musk was in my DMs!&nbsp;This was it — my chance to talk to one of the brightest minds of our time, and he was personally reaching out to me. Why? Who cares! I was about to chat with the guy who’s going to Mars!&nbsp;At first, the conversation was casual — just some basic pleasantries, like two regular humans do. The weather? Sure, Elon. Then I thought, "Let’s spice this up a bit." I casually mentioned that I hoped to afford a Tesla someday. Full disclosure: I don’t even have a driver’s license, so it’d be pretty useless for me. But hey, I wanted to see if we could transition into the topic of finances.&nbsp;

Boy, did Elon bite!&nbsp;&nbsp;He was super excited and told me how he could help me increase my wealth. That’s right — Elon Musk, the guy who could buy entire countries, was going to help me make some extra cash. How generous of him!&nbsp;

That’s when things got … interesting. He suddenly asked if I had an app called Zangi. I had never heard of Zangi, but after a quick search, I figured, “Why not?” This was Elon Musk asking, after all.&nbsp;

We switched over to Zangi, and no sooner had I blinked than he was asking me to download yet another app: Skrill. This one rang a few more alarm bells. Skrill is a payment app that deals in cryptocurrencies and money transfers — two things you really don’t want to be messing with if you don’t know what you’re doing.&nbsp;

Then came the moment Elon sent me a screenshot of someone else’s success story. Apparently, "Hailey M." had followed the exact same steps and made over $13,000 in no time. Wow, what are the odds? It was almost like a well-rehearsed script! 😉😉&nbsp;

At this point, I’d had enough, so I decided to ignore him. Funny enough, 11 days later I got a message in Zangi from a different profile claiming to be Elon Musk. It was clear the scammer was still at it — he was the only one with my contact info from our previous conversation.&nbsp;&nbsp;As for the original TikTok account that reached out to me? It ended up exactly where it belonged: banned. Unfortunately, that’s not the end of the story.&nbsp;

But not all the news is good. There are tens of fake Elon Musk accounts on TikTok, amassing millions of followers. While a few are parody or fan-based accounts, most are designed with far more malicious intent.

How to Spot and Avoid Social Media Scams&nbsp;Scammers are constantly evolving their tactics, but there are several red flags to watch for that can help you avoid falling victim. Here are some essential tips to protect yourself: &nbsp;<ol><li>Beware of Unsolicited Offers: If someone, especially a public figure or celebrity, reaches out offering investment opportunities or promises of financial gain, it's almost always a scam. High-profile individuals do not offer private deals through social media.&nbsp;</li><li>Examine the Profile Closely: Look for inconsistencies, such as a lack of followers, minimal posts or unusual usernames. Scammers often create fake profiles that appear legitimate at first glance but reveal their true nature upon closer inspection.&nbsp;</li><li>Private Accounts and Limited Activity: Be wary of private accounts claiming to belong to public figures. Celebrities and business leaders typically have public profiles with verified and authentic engagement.&nbsp;</li><li>Watch for Pressure Tactics: Scammers will often push for a quick response or urge you to act immediately. They may also ask you to switch platforms (like moving from TikTok to a lesser-known app) to avoid detection.&nbsp;</li><li>Never Share Personal Information: Never provide your phone number, email or other personal information to accounts you're not sure about. Scammers often ask for this info to escalate the scam through more direct communication methods.&nbsp;</li><li>Resist Temptation of the “Too Good to Be True” Offers: Whether it's a promise of fast wealth or unbelievable returns on investment, remember that if something seems too good to be true, it probably is.&nbsp;</li><li>Use Tools to Verify Scams: Before engaging with any suspicious account or offer, use a tool like Norton Genie. This AI-powered solution can help identify if you are dealing with a scam, providing you with instant feedback and peace of mind.&nbsp;</li><li>Use Security Software: Always ensure you have reputable security software installed on your devices. Tools like Norton, Avast and AVG offer real-time protection against malware and phishing attempts, which will protect you if you're directed to a malicious site.&nbsp;</li><li>Report Suspicious Accounts: If you suspect an account is fake or engaging in fraudulent activity, report it to the platform. Social media companies rely on user reports to identify and remove harmful accounts.&nbsp;</li></ol>Below is an example of how <a href="https://us.norton.com/products/genie-scam-detector" target="_blank" title="Norton Genie">Norton Genie</a> swiftly handles this type of scams just through sending a screenshot with a fraction of the conversation. Always remember: When in doubt, trust your instincts, use trusted tools and never let the allure of fast wealth cloud your judgment. Stay safe and vigilant!&nbsp;

A shocking encounter with a fake Elon Musk and tips to avoid social media scams

How Elon Musk 'Almost' Made Me Rich: A TikTok Tale

Over the past four weeks, we've protected more than 1.4 million customers against attempts to distribute malware through various fake Captcha campaigns, highlighting the sheer scale and persistence of these attacks. The primary malware being distributed, Lumma Stealer, poses a significant threat to users as it is designed to steal sensitive information, such as login credentials, cryptocurrency wallets, and other valuable data. This makes it a dangerous tool in the hands of cybercriminals, who can use it for identity theft, financial fraud, and further attacks.&nbsp;The latest campaign as part of these Captcha-style attacks launched just days ago and begins with a phishing email, which falsely claims to be from the GitHub Security Team, alerting the recipient to a security vulnerability in their repository. The email directs the user to a malicious website, as shown in the first image below.

Once the user clicks the link, they are redirected to a fake Captcha screen that prompts them to verify their identity by clicking on a button:&nbsp;

This action copies a malicious script to the user’s clipboard, followed by instructions on how to execute it. These instructions inadvertently lead the user to run the script, thereby infecting their own system. The instructions may suggest using the system's command line or, as in this case, the Win+R prompt:&nbsp;

The provided script, which is a malicious PowerShell command, contacts a command-and-control (C&amp;C) server to download additional malicious payloads. The primary objective is to download and execute the Lumma Stealer or an intermediary loader that eventually drops Lumma Stealer on the victim’s system.&nbsp;Under the hood, the button functionality is enabled by a small JavaScript that ensures copying of the PowerShell command into the user’s clipboard via the “I’m not a robot” button:&nbsp;

After the user pastes the command into their command line or the Win+R prompt, the script will download and execute additional PowerShell script from https://github-scanner[.]com/download.txt:&nbsp;

This script contacts the C&amp;C server once again and downloads an executable file called l6E.exe. This is the final Lumma Stealer payload which is downloaded to a Temp folder under the name SysSetup.exe, and executed.&nbsp;&nbsp;<h5>Geographical Spread of Fake Captcha Campaigns&nbsp;</h5>For a long time, we have been closely monitoring various fake Captcha campaigns. In the past four weeks alone, we have protected over 1.4 million unique users, highlighting the massive and widespread impact of these attacks. The heatmap below shows the regions most affected by fake Captcha attacks during this period. The 5 most affected countries are Italy, Argentina, France, Spain and Brazil.&nbsp;

<h5>Indicators of Compromise (IoCs)&nbsp;</h5>C&amp;C:https://github-scanner[.]comPowerShell script:10d4e15b63a07368299f2245661d7a4626cd1a91a9950a3cbed5b4276d2dc31fLumma Stealer:d737637ee5f121d11a6f3295bf0d51b06218812b5ec04fe9ea484921e905a207

<h5>Protecting Yourself&nbsp;</h5>We recommend the following tips to help protect yourselves from Captcha campaigns:&nbsp;<ul><li>Be Skeptical of Unsolicited Emails: Always verify the authenticity of unexpected emails, especially those prompting you to take immediate action on your repositories.&nbsp;</li><li>Do Not Execute Unknown Scripts: Never run scripts or commands from untrusted sources. Verify the script's content and origin before executing it.&nbsp;</li><li>Enable Two-Factor Authentication (2FA): Adding an extra layer of security can help protect your accounts even if your credentials are compromised by information stealers like Lumma Stealer.&nbsp;</li><li>Use a Reputable Antivirus Solution: Make sure you have a reliable antivirus solution, such as those offered by Gen (Avast, AVG, Avira, or Norton), installed and regularly updated on your devices. These solutions provide essential protection against malware like Lumma Stealer, detecting and blocking malicious scripts and payloads before they can cause any harm. Even if you accidentally interact with a phishing attempt, having a trusted security solution in place can act as a crucial safety net.&nbsp;</li></ul>&nbsp;<h5>Conclusion&nbsp;</h5>We are actively monitoring these attacks and will continue to keep you updated with the latest developments. Our team is committed to staying ahead of these threats, and if there are any new updates, we will share them here and in&nbsp; X (<a href="https://x.com/GenThreatLabs">https://x.com/GenThreatLabs</a>). Staying informed and taking proactive steps to protect yourself are key to staying safe online.&nbsp;For more information about recent campaigns also distributing Lumma Stealer, you can refer to our previous analysis <a href="https://www.gendigital.com/blog/news/innovation/lumma-stealer-github">here</a>. Stay safe and informed!&nbsp;

How Fake Captcha Campaigns are Distributing Lumma Stealer

Global Surge in Fake Captcha Attacks 

In early June, we discovered a sample that was exploiting a new zero-day vulnerability within Winsock driver (CVE-2024-38193) to achieve local privilege escalation to deploy a new version of FudModule rootkit. We determined that the sample was part of a Lazarus Group operation that was targeting potentially sensitive industries such as aerospace and cryptocurrency engineering to gain access to their corporate networks.CVE-2024-38193 is a use-after-free vulnerability in the <code>AFD.sys</code> driver which is responsible for kernel-mode support for the Windows socket (Winsock) interface used in network communication. This flaw allowed attackers to tamper with certain values in kernel structures, leading to read/write access which was leveraged by FudModule to execute a Direct Kernel Object Manipulation technique. This vulnerability is present on Windows 11 Version 23H2 (and earlier) and Windows 10.The FudModule itself has also undergone a significant evolution. In addition to its usual arsenal, it started to disable crash dumps to further complicate any investigation. It is also more closely tied to the payload it aims to protect, which it injects into a process secured by Protected Process Light. These extensive changes led us to a decision to denote this version as FudModule v3.0.<h2>Initial access</h2>Previous versions of FudModule (v2.0) were <a href="https://decoded.avast.io/luiginocamastra/from-byovd-to-a-0-day-unveiling-advanced-exploits-in-cyber-recruiting-scams/">delivered by Kaolin RAT</a>, utilizing another zero-day exploit (CVE-2024-21338) to gain read/write access to the kernel memory. Unfortunately, we’ve been unable to determine how CVE-2024-38193 was delivered, along with FudModule v3.0, to the victim’s device.On August 19, 2024, Microsoft identified a North Korean threat actor exploiting a Chromium remote-code-execution (RCE) zero-day vulnerability (CVE-2024-7971) which was based on a type of confusion issue in the V8 JavaScript engine and WebAssembly engine. <a href="https://www.microsoft.com/en-us/security/blog/2024/08/30/north-korean-threat-actor-citrine-sleet-exploiting-chromium-zero-day/">Microsoft noted</a> that Citrine Sleet used Chromium exploit to deploy a FudModule rootkit, nevertheless, they did not specify more technical details on the rootkit. The RCE vulnerability was used to deploy a shellcode containing another exploit (CVE-2024-38106) that was used to escape Chromium’s sandbox and deploy the downloaded FudModule rootkit into the memory.&nbsp;Due to the timing of this attack and a close presumed relation between Citrine Sleet and Lazarus group, we presume that the FudModule v3.0 and Winsocks exploit (CVE-2024-38193) may have been delivered in a very similar manner.<h2 class="text-align-justify">FudModule Rootkit delivery</h2>In the first version of the FudModule, referred to as FudModule v1.0, the attacker required the ability to modify kernel memory structures, potentially resulting in the deactivation of Windows monitoring features. To achieve this, they employed the Bring Your Own Vulnerable Driver (BYOVD) technique, a well-known method where attackers load a legitimate, signed, and vulnerable kernel driver to bypass the Driver Signature Enforcement (DSE) policy. The attacker then used this known vulnerability to obtain read/write access to the kernel space.They accomplished this by loading vulnerable drivers such as <code>dbutil_2_3.sys</code> (Dell driver) and <code>ene.sys</code> (RGB lightning control driver), exploiting them using N-day vulnerabilities. This is a straightforward method, as there are numerous publicly available proof-of-concept exploits for various vulnerabilities. However, the downside is that the attacker must drop the vulnerable driver onto the filesystem and load it with administrator privileges.The second version of the FudModule, referred to as FudModule v2.0, was discovered by Gen. In this case, the attackers exploited a zero-day vulnerability (CVE-2024-21338) in the Windows’ <code>appid.sys</code> (Application Identity driver). The key advantage of this choice is that this driver is already present on Windows 10 and Windows 11 by default, eliminating the need to drop “your” own vulnerable driver.However, a challenge with this approach is that the attacker needed administrator privileges to send the vulnerable IOCTL code (<code>0x22A018</code>) to the <code>appid.sys</code> driver. For more technical details about this exploit, see our <a href="https://decoded.avast.io/janvojtesek/lazarus-and-the-fudmodule-rootkit-beyond-byovd-with-an-admin-to-kernel-zero-day/">previous blogpost</a> on this vulnerability.In this new instance, the attackers discovered a way to exploit a vulnerability in the default driver without requiring administrator privileges to interact with it. &nbsp;They identified a zero-day vulnerability in the <code>AFD.sys</code> (Winsocks driver) to achieve read/write (R/W) access in kernel space. After triggering the vulnerability in <code>AFD.sys</code>, the attackers first had to gain increment primitive, crafting a specific kernel address to achieve temporary R/W primitive. With these temporary primitives, they were able to corrupt the <code>PreviousMode</code> field of the current thread in the <code>KTHREAD</code> structure. By modifying the <code>PreviousMode</code>, they could bypass kernel mode checks within system calls such as <code>NtReadVirtualMemory</code> or <code>NtWriteVirtualMemory</code>, and stealthily deploy FudModule v3.0.<h2>FudModule rootkit</h2>The FudModule v1.0 was discovered by the <a href="https://www.virusbulletin.com/uploads/pdf/conference/vb2022/papers/VB2022-Lazarus-and-BYOVD-evil-to-the-Windows-core.pdf">ESET</a> and AnhLab in September 2022. They described 7 techniques used to disarm security solutions and monitoring tools.In June of last year, our discovery of the FudModule 2.0 lead to a sample featuring nine techniques, out of which four were new and three were improved, with another two remaining unchanged.In FudModule 3.0, eight techniques from the previous version remain unchanged, and one technique was removed in favour of two new techniques. The unchanged functions, are:<ul><li>Disable a security solution ability to monitor registry operations</li><li>Disable object callbacks routine which is which is used to execute a custom code response to thread, process, and desktop handle operations.</li><li>Disable process, thread and image kernel callbacks</li><li>Disabling all monitoring and antivirus file system minifilters</li><li>Disable network traffic filtering (happens only if Kaspersky drivers are present and at the same time Symantec/Broadcom drivers are absent).</li><li>Two approaches to Disabling all system loggers in a more generic way in Event Tracing for Windows (ETW)</li><li>Disable monitoring of <code>MsMpEng.exe</code> process (Microsoft Defender) via handle table manipulation. For <code>asdsvc.exe</code> (AhnLab Smart Defense Service), the rootkit clears the <code>_EPROCESS.Protection</code> byte, reducing it to a standard, non-protected process after the modification.</li></ul>The function responsible for disabling image verification callbacks is no longer present in FudModule v3.0.&nbsp;Now, we’ll dive into the two new techniques included in FudModule v3.0.

<h3>Disabling crash dump</h3>In FudModule v3.0 rootkit, disabling a crash dump is the first technique to be executed after a successful exploitation. Since FudModule v3.0 directly manipulates kernel structures, which could potentially cause a system crash, it employs a method to prevent the creation of crash dump files. Crash dump files capture the system's memory at the time of an error, including loaded drivers, running processes, and active kernel data. If a crash dump file caused by the rootkit were saved, it could provide leads to the exploit during the crash investigation, which could expose the zero-day before gaining foothold on the device.To disable crash dump, the rootkit first locates the virtual address of the data sections of the <code>crashdmp.sys</code> driver and <code>ntoskrnl.exe</code> (kernel image) in memory. It then scans for pointer in the data section of <code>ntoskrnl.exe</code>; more specifically it is looking for a pointer pointing to the data section of <code>crashdmp.sys</code> which is a global pointer named CrashdmpDumpBlock. It then zeroes out this pointer which effectively prevents the system from generating a crash dump.

<h3>Shellcode Injections</h3>The second technique, shellcode injection, is rather peculiar in the sense that it makes a shift from FudModule v2.0 as a final payload to FudModule v3.0 used as a stager for another payload. The process involves two consecutive shellcode injections into different processes: one into <code>services.exe</code> and the other into <a href="https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/msiexec"><code>msiexec.exe</code></a>.Initially, memory pages are allocated within these processes, their permissions modified to allow execution, and <code>_EPROCESS.MitigationFlags</code> is cleared to avoid instability if the handle table manipulation goes awry.

In the case of <code>services.exe</code> injection, FudModule uses a non-protected process. This should protect it from acquiring a handle to processes protected by PPL (Protected Process Light) such as <code>services.exe</code>, <code>wininit.exe,</code> or <code>csrss.exe</code>. Nevertheless, FudModule exploits the kernel Read/Write primitive to gain direct access to the handle table. This way, it can craft a custom handle table entry, gaining control over both referenced object and its access bits, effectively bypassing PPL. Then <a href="https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/msiexec"><code>msiexec.exe</code></a> process is spawned from within this context.

Previously in v2.0, FudModule used a dummy thread to insert an entry into the handle table and subsequently modified the referenced object to target specific processes (in order to disable security solutions). In v3.0, a more sophisticated approach is used: FudModule uses <code>NtDuplicateObject</code> function to duplicate the current process handle, creating another entry in the handle table. This new entry points to the <code>_OBJECT_HEADER</code> of the target <code>_EPROCESS</code> – in our case <code>services.exe</code>.The second injection, targeting the <a href="https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/msiexec"><code>msiexec.exe</code></a> spawned by the first injection, simply aims to decrypt and prepare a payload before executing it. This payload is passed as an argument by the initial 0-day containing shellcode.This development marks an interesting shift in the FudModule's functionality. Instead of being the final payload by itself, it serves as a loader that abuses its access into PPL-protected processes to improve stealthiness of the final payload and hinder detection and tracing.<h2>Conclusion</h2>The Lazarus cybercriminal group, one of the long-standing APT (Advanced Persistent Threat) groups, has once again surprised the cybersecurity community. Lazarus continues to aggressively utilize new zero-day vulnerabilities, targeting not just operating systems but also browsers to effectively deliver their payloads. This time, they even went one step further by going from BYOVD to directly exploiting system drivers.Since the discovery of the FudModule, it has been clear that this rootkit is under active development. Its aim appears to be achieving long-term persistence and improved stealth capabilities to bypass built-in security features and evade detection from security vendors. Its latest evolution seems to shift its purpose from a standalone rootkit for disarming security solutions to a more generic rootkit that also actively protects the associated payload. Despite our extensive research, we have not yet uncovered the exact method used to deliver the Local Privilege Escalation (LPE) exploit alongside the FudModule v3.0 rootkit. However, based on the research from Microsoft, we now believe that the LPE exploit could have been delivered through a Remote Code Execution (RCE) vulnerability in Google Chrome.<h2>Indicators of Compromise (IoCs)</h2>A YARA rule for the FudModule v3.0 is available at <a href="https://github.com/avast/ioc/tree/master/FudModule#yara">github.com/avast/ioc</a>

Evolution of Lazarus ‘FudModule - no longer (stand)alone’

Malware Researcher

Malvertising is one of the dark sides of pervasive advertising on the modern web that continues to retain its relevance despite attempts to curb it. Investigation of the Lumma stealer’s infection chain led us to believe that there is a new contender in the malvertising field. This new malvertising platform is mostly focused on people in Europe, particularly France and Poland. Their current campaign is exploiting known vulnerabilities in outdated versions of Chrome. This typically affects users of out-of-live versions of Windows versions, such as Windows 7, which are no longer supported with the latest Chrome versions. At the same time, our telemetry has shown us a significant increase in Magniber ransomware activity within the same timeframe, leading to a suspicion that these activities may be linked.We have dubbed this new suspected malvertising provider AliGater. Like other malvertising platforms, they rely on legitimate ad services to redirect unsuspecting victims to their gateway. This gateway fingerprints the user, filters out potential victims and then redirects them to a malicious domain that will try to exploit vulnerabilities in their system. These exploits attempt to stealthily deploy the final payload using common tricks, such as embedding it within multiple legitimate-looking processes and threads.We will primarily focus on identifying the main components of AliGater’s operation, used exploits and provide insight into prevalence of this new malvertising provider.<h2>Infection Chain</h2>

The infection chain starts with an advertisement that redirects the unsuspecting victim to the initial gateway&nbsp;<code>aligate.homes</code>. This gateway fingerprints the user and, likely using the browser’s user agent, determines whether the victim may be susceptible to their exploits. Users that are identified as exploitable are redirected to a simple website mimicking a simple Google CAPTCHA. The rest are redirected to the legitimate AliExpress home page.

The purpose of this fake CAPTCHA is to fetch a JS script (<code>captcha.js</code>) from&nbsp;<code>https://{random_chars}.{two_random_words}.shop</code> that will fingerprint the victim’s environment (architecture, platform, WebGL, Chrome version) and send it to the C&amp;C server. Based on this information, the C&amp;C server will deliver a specific malicious payload tailored to the victim’s Windows and Chrome versions. This payload takes the form of an obfuscated JS with encrypted byte arrays with shellcodes. We have observed payloads containing exploits targeting JavaScript engine V8 (CVE-2023-2033) and a TrueType font parsing in Windows (CVE-2011-3402).<h5>Chrome Exploit (stage 1)</h5>The first encrypted buffer in the final JS contains a WebAssembly (Wasm) module which is decrypted using an XOR cipher with a variable-length key located at the beginning of the main encrypted buffer. The purpose of the Wasm module is to invoke a method that operates with an array of a different type than intended, leading to illegal access and manipulation of specific memory addresses. Consequently, the native shellcode (Stage 1) hidden in the second array is executed within the Chrome process utilizing the Wasm module.Stage 1, invoked by the Wasm module, consists of a simple code that searches the memory of the Chrome process for the key at the beginning of the first buffer within the final JS. Once the buffer is located and decrypted, the code execution jumps to stage 2, which then tries to exploit the Windows system.<h5>Windows Exploit (stage 2)</h5>The Win32 TrueType font parsing is an old known exploit (CVE-2011-3402) abused by the attackers to elevate the necessary privileges for subsequent operations. If the exploit is successful, stage 2 enumerates all processes in the system and attempts to open each one. Next, it injects a third stage into the opened process.<h5>Process Camouflage (stage 3)</h5>The purpose of this stage is to stealthily deploy the next stage (stage 4). Stage 3 creates a new, elevated process with the well-known system process names, such as <code>dllhost.exe</code>, <code>SearchIndexer.exe</code>, <code>spoolsv.exe</code>, <code>svchost.exe</code>, and <code>taskhost.exe</code>, and then injects the fourth stage into this new process.<h5>Payload Downloader (stage 4)</h5>Fourth stage is a simple stager that downloads the next stage (stage 5) via HTTP from a hardcoded URL, which is typically formatted as&nbsp;<code>http://&lt;IP&gt;/{two_random_words}.jpg</code>. The IP corresponds to the DNS record of one of the <code>*.shop</code> servers. Note that the actual IP address may differ from the one that was used to deliver said JS script. The downloaded shellcode is not encrypted and is executed directly using the processes with elevated privileges.<h5>Executor (stage 5)</h5>This last AliGater stage is responsible for deploying the final payload embedded within <code>*.jpg</code> file that has been downloaded in the previous stage. This stage will use a two-pronged approach to deploying the final payload.It will spawn another process from the <code>explorer.exe</code> processes, again from a list of well-known Windows executables (<code>pcaui.exe</code>, <code>SearchIndexer.exe</code>, <code>svchost.exe</code>, <code>systray.exe</code>, or <code>dllhost.exe</code>), which will be injected with the final payload. In a similar manner, it will also attempt to open another elevated process and execute the final payload from within. Therefore, the final payload may be executed twice. The final payload that has been distributed at the time of research has been identified as Lumma stealer.

<h2>Similarities to Ongoing Magniber Campaign</h2>While researching this new threat actor, we have also noticed a spike in Magniber activity. While we were unsuccessful in retrieving the final payload of Magniber campaign through AliGater, we could not help but notice many similarities between these two campaigns. The registration date of the <code>alligate.home</code> domain is tightly correlated with Magniber campaign. Moreover, we have noticed multiple parallels in specific parts of the AliGater’s infection chain and Magniber. Magniber and AliGater’s stagers use unusual methods of invoking syscalls and target the same group of victims: Windows 7 systems in Europe. They also used a very similar approach to string encryption. Due to this, we strongly believe that Magniber’s codebase and the codebase used for AliGater's stagers are related. This leads to a conjecture that Magniber’s authors may have started offering their infrastructure as a service.<h2>Command &amp; Control Infrastructure</h2>The C2 infrastructure is used to&nbsp;identify potential victims, deliver tailored exploits to their browsers and provide the final payload to be executed on the compromised machine. It consists of three key elements:<ol><li>Gateway – Facilitates initial contact and filters out potentially suspicious or unperceptive (read not exploitable) visitors before redirecting exploitable victim to a malicious domain.</li><li>Malicious domain – Fingerprints the visitor and delivers tailored exploits and shellcodes to the victim.</li><li>Payload distribution – Once the victim’s environment is assessed and a suitable payload is chosen, distribution endpoint will provide the final payload to the stager deployed by the exploit.</li></ol>&nbsp;

<h6>Gateway</h6>The malicious gateway, operating at IP address&nbsp;<code>176.31.142.36</code> and associated with the DNS record&nbsp;<code>aligate.homes</code> (created on July 6, 2024), employs several mechanisms to manage traffic and avoid detection. The main method preventing the gate analysis is IP filtering, ensuring that repeated requests from the same IP address are not allowed –&nbsp;<code>HTTP ERROR 404</code>.Users who are assessed as non-exploitable are redirected to the official AliExpress website using a&nbsp;<code>&lt;meta&gt;</code> refresh tag. However, users identified as potentially exploitable are redirected to the Malicious Domain. This redirection occurs via the&nbsp;<code>HTTP 302 Found</code> response, which includes a&nbsp;<code>Location</code> header that is dynamically generated.<h6>Malicious Domains</h6>The potential victim is redirected to the Malicious Domain following a specific naming convention:&nbsp;<code>https://{random_chars}.{two_random_words}.shop</code>. The&nbsp;<code>two_random_words</code> component of the domain name represents the malicious domain, which is alive approximately three days, and shares the same registrant for domains we observed. The subdomain, represented by&nbsp;<code>random_chars</code>, changes rapidly — approximately every second — to make detection and tracking more difficult.&nbsp;<h6>Payload Distribution</h6>IP addresses of the payload distribution endpoint are hardcoded within stage 4. Similarly to the same DNS where they always use the same registrant, the IP addresses belong to the same ASN number. Interestingly, these IP addresses are also frequently associated with other malicious domains of AliGater.<h2>Detections</h2>Our telemetry indicates that AliGater focuses primarily on outdated versions of Windows and Chrome systems. The most affected Windows versions are Windows 7 with SP1 followed by Windows 8.1. The reason behind this choice is simple – these are no longer supported by new Chrome versions, meaning that any discovered vulnerabilities are left unfixed.

The overwhelming majority of targeted systems used the following user agent:<code>Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36(KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36</code>In point of affected countries, the most prevalent locations are France and Poland, followed by Italy, Spain and Turkey. Based on this data, we assess that the European states are the campaign’s main targets.

<h2>Conclusion</h2>AliGater is the result of an unfortunate conjunction of two phenomena. The pervasiveness of the web advertising industry makes it a ripe target for malicious actors looking for delivery vehicles for their business. Similarly, there are still a huge number of people relying on outdated versions of Windows that are inherently locked due to old, unsupported versions of Chrome (and their software in general). This combination was exploited to deliver a complex multi-stage attack vector that utilizes the ad industry to redirect victims to their infrastructure and exploit their systems to deliver Lumma stealer.As per usual in the malvertising industry, AliGater’s infrastructure is highly dynamic, frequently cycling newly registered domains. Despite this dynamic, some patterns, such as registrants or ASN numbers, remain consistent.We have also noticed many similarities between Magniber and AliGater’s stagers. More specifically, their coding styles have multiple similarities and use the same unusual and inherently very limiting patterns. This leads us to believe that Magniber and AliGater’s stager binaries are related. This raises a possibility that Magniber’s authors may have started to offer their infrastructure as a service. Nevertheless, due to our limited knowledge of the Magniber infection chain, we cannot provide an assessment of this conjecture.In conclusion, AliGater’s ability to exploit outdated systems through suspicious ad services poses a significant security risk, particularly in Europe, which seems to be their primary focus. We can assume that AliGater may distribute other malware and that Magniber’s authors might expand their operation to include other threat actors. Therefore, we intend to continue monitoring their operations to understand their operation, infrastructure, and capabilities better.