Beware: Fake Facebook Job Ads Spreading ‘Ov3r_Stealer’ to Steal Crypto and Credentials

Risk actors are leveraging bogus Facebook position adverts as a lure to trick future targets into putting in a new Windows-centered stealer malware codenamed Ov3r_Stealer.

“This malware is built to steal qualifications and crypto wallets and mail all those to a Telegram channel that the threat actor screens,” Trustwave SpiderLabs mentioned in a report shared with The Hacker News.

Ov3r_Stealer is capable of siphoning IP deal with-centered area, hardware info, passwords, cookies, credit history card information and facts, auto-fills, browser extensions, crypto wallets, Microsoft Business office files, and a checklist of antivirus items put in on the compromised host.

Although the specific end target of the campaign is unfamiliar, it’s possible that the stolen facts is available for sale to other risk actors. A further risk is that Ov3r_Stealer could be up to date around time to act as a QakBot-like loader for added payloads, which include ransomware.

The starting off level of the attack is a weaponized PDF file that purports to be a file hosted on OneDrive, urging users to simply click on an “Entry Doc” button embedded into it.

Trustwave explained it determined the PDF file becoming shared on a phony Fb account impersonating Amazon CEO Andy Jassy as nicely as through Facebook adverts for digital promotion work.

Users who finish up clicking on the button are served an internet shortcut (.URL) file that masquerades as a DocuSign doc hosted on Discord’s written content delivery network (CDN). The shortcut file then functions as a conduit to provide a command panel item (.CPL) file, which is then executed working with the Windows Handle Panel course of action binary (“command.exe”).

The execution of the CPL file leads to the retrieval of a PowerShell loader (“Facts1.txt”) from a GitHub repository to finally launch Ov3r_Stealer.

It truly is well worth noting at this stage that a around-similar an infection chain was lately disclosed by Development Micro as obtaining set to use by risk actors to drop a different stealer named Phemedrone Stealer by exploiting the Microsoft Windows Defender SmartScreen bypass flaw (CVE-2023-36025, CVSS score: 8.8).

The similarities extend to the GitHub repository utilised (nateeintanan2527) and the actuality that Ov3r_Stealer shares code-stage overlaps with Phemedrone.

“This malware has lately been noted, and it may well be that Phemedrone was re-purposed and renamed to Ov3r_Stealer,” Trustwave reported. “The primary distinction between the two is that Phemedrone is published in C#.”

The findings occur as Hudson Rock revealed that menace actors are promotion their accessibility to law enforcement ask for portals of big companies like Binance, Google, Meta, and TikTok by exploiting qualifications attained from infostealer infections.

They also comply with the emergence of a category of bacterial infections termed CrackedCantil that consider leverage cracked software as an preliminary entry vector to fall loaders like PrivateLoader and SmokeLoader, when subsequently act as a shipping system for facts stealers, crypto miners, proxy botnets, and ransomware.

Discovered this post fascinating? Observe us on Twitter  and LinkedIn to examine more exceptional content we write-up.

Some sections of this write-up are sourced from:
thehackernews.com