Beware: Fake Browser Updates Deliver BitRAT and Lumma Stealer Malware

Pretend web browser updates are becoming applied to supply distant entry trojans (RATs) and information stealer malware these types of as BitRAT and Lumma Stealer (aka LummaC2).

“Pretend browser updates have been responsible for a lot of malware infections, which include those people of the well-known SocGholish malware,” cybersecurity firm eSentire stated in a new report. “In April 2024, we observed FakeBat staying distributed by way of equivalent pretend update mechanisms.”

The attack chain commences when possible targets visits a booby-trapped internet site that is made up of JavaScript code developed to redirect customers to a bogus browser update web site (“chatgpt-app[.]cloud”).

The redirected web webpage comes embedded with a download url to a ZIP archive file (“Update.zip”) that is hosted on Discord and downloaded mechanically to the victim’s unit.

It is really really worth pointing out that danger actors usually use Discord as an attack vector, with a the latest analysis from Bitdefender uncovering extra than 50,000 perilous inbound links distributing malware, phishing strategies, and spam more than the past 6 months.

Existing inside the ZIP archive file is an additional JavaScript file (“Update.js”), which triggers the execution of PowerShell scripts dependable for retrieving more payloads, which includes BitRAT and Lumma Stealer, from a distant server in the type of PNG graphic information.

Also retrieved in this manner are PowerShell scripts to set up persistence and a .NET-dependent loader which is mainly employed for launching the last-phase malware. eSentire postulated that the loader is most likely marketed as a “malware shipping and delivery assistance” owing to the simple fact that the very same loader is utilised to deploy each BitRAT and Lumma Stealer.

BitRAT is a element-abundant RAT that enables attackers to harvest info, mine cryptocurrency, down load additional binaries, and remotely commandeer the infected hosts. Lumma Stealer, a commodity stealer malware accessible for $250 to $1,000 per month because August 2022, provides the potential to capture facts from web browsers, crypto wallets, and other sensitive details.

“The phony browser update lure has turn out to be frequent amongst attackers as a signifies of entry to a machine or network,” the company reported, adding it “shows the operator’s potential to leverage reliable names to optimize get to and impression.”

When this sort of attacks commonly leverage drive-by downloads and malvertising techniques, ReliaQuest, in a report printed previous week, mentioned it discovered a new variant of the ClearFake marketing campaign that tips users into copying, pasting, and manually executing destructive PowerShell code under the pretext of a browser update.

Specifically, the malicious web page claims that “something went completely wrong though exhibiting this webpage” and instructs the internet site visitor to install a root certification to address the issue by subsequent a series of methods, which requires copying obfuscated PowerShell code and running it in a PowerShell terminal.

“On execution, the PowerShell code performs a number of features, including clearing the DNS cache, displaying a message box, downloading even more PowerShell code, and setting up ‘LummaC2’ malware,” the company explained.

According to information shared by the cybersecurity firm, Lumma Stealer emerged as a single of the most widespread facts stealers in 2023, alongside RedLine and Raccoon.

“The range of LummaC2-obtained logs mentioned for sale elevated by 110% from Q3 to Q4 2023,” it famous. “LummaC2’s mounting popularity between adversaries is likely because of to its superior good results charge, which refers to its effectiveness in efficiently infiltrating units and exfiltrating sensitive information with out detection.”

The improvement will come as the AhnLab Security Intelligence Centre (ASEC) disclosed facts of a new campaign that employs webhards (shorter for web challenging drive) as a conduit to distribute destructive installers for grownup online games and cracked variations of Microsoft Workplace and eventually deploy a selection of malware this sort of as Orcus RAT, XMRig miner, 3proxy, and XWorm.

Equivalent attack chains involving web sites featuring pirated application have led to the deployment of malware loaders like PrivateLoader and TaskLoader, which are each supplied as a spend-for every-install (PPI) service for other cybercriminals to deliver their individual payloads.

It also follows new conclusions from Silent Push about CryptoChameleon’s “nearly special use” of DNSPod[.]com nameservers to aid its phishing kit architecture. DNSPod, part of the Chinese company Tencent, has a background of giving providers for malicious bulletproof hosting operators.

“CryptoChameleon employs DNSPod nameservers to have interaction in speedy flux evasion techniques that allow for menace actors to swiftly cycle as a result of large amounts of IPs connected to a single area title,” the company stated.

“Rapid flux allows CryptoChameleon infrastructure to evade classic countermeasures, and considerably decreases the operational benefit of legacy issue-in-time IOCs.” making use of at the very least seven most important social media accounts and a CIB network of much more than 250 accounts.

Observed this posting attention-grabbing? Abide by us on Twitter  and LinkedIn to read a lot more exclusive information we publish.

Some elements of this article are sourced from:
thehackernews.com