A recent malware campaign has been discovered distributing a new information stealer called EDDIESTEALER, developed in Rust, using a deceptive social engineering tactic known as ClickFix. This campaign involves fake CAPTCHA verification pages that trick users into executing a malicious PowerShell script, leading to the installation of the infostealer, which can extract sensitive data such as credentials, browser information, and cryptocurrency wallet details. The attack begins with compromising legitimate websites with malicious JavaScript payloads that serve fraudulent CAPTCHA check pages, prompting visitors to follow a three-step process to execute the PowerShell command.
The JavaScript payload retrieved from an external server is saved on the victim’s system and executed to fetch the EDDIESTEALER binary, which can collect system metadata, receive commands from a command-and-control (C2) server, and extract data from various sources like cryptocurrency wallets, web browsers, and messaging apps. The stolen information is encrypted and sent to the C2 server through HTTP POST requests after each task is completed. EDDIESTEALER also incorporates mechanisms to evade detection, such as a custom WinAPI lookup method, sandbox detection, and a self-deletion technique similar to other malware variants.
One notable feature of EDDIESTEALER is its ability to bypass Chromium’s app-bound encryption to access unencrypted data like cookies, achieved through a Rust implementation of ChromeKatz. This tool can dump cookies and credentials from Chromium-based browsers’ memory, even spawning a new browser instance if necessary. Updated versions of the malware have been observed with additional functionalities, such as harvesting system information and altering the C2 communication pattern. The encryption key for communication is hardcoded into the binary, rather than being dynamically retrieved from the server.
The evolving nature of this malware campaign highlights the ongoing efforts of threat actors to develop sophisticated techniques for data theft and system compromise. It is essential for users to remain vigilant against social engineering tactics and regularly update security measures to protect against such threats. As cybersecurity researchers continue to analyze and combat these malicious activities, staying informed about the latest developments in malware tactics is crucial for safeguarding against potential attacks. A new malware stealer has been discovered using the DevTools Protocol over a local WebSocket interface without needing user interaction. This adoption of Rust in malware development shows a trend of threat actors utilizing modern language features for improved stealth and resilience against detection engines. The company disclosed details of a ClickFix campaign targeting multiple platforms, including Apple macOS, Android, and iOS, using techniques like browser-based redirections and drive-by downloads.
The attack chain begins with an obfuscated JavaScript hosted on a website that redirects macOS users to a page instructing them to run a shell script, leading to the download of a stealer malware known as the Atomic macOS Stealer (AMOS). The same campaign triggers a drive-by download scheme for Android, iOS, and Windows devices, deploying a trojan malware.
New stealer malware families, such as Katz Stealer and AppleProcessHub Stealer, have been identified targeting Windows and macOS. Katz Stealer circumvents Chrome’s app-bound encryption by using DLL injection to decrypt encrypted cookies and passwords from Chromium-based browsers. Attackers hide malicious JavaScript in gzip files to trigger the download of a PowerShell script, which retrieves a .NET-based loader payload to inject the stealer into a legitimate process.
AppleProcessHub Stealer is designed to exfiltrate user files like bash history, GitHub configurations, and iCloud Keychain. The malware uses a Mach-O binary to download a second-stage bash stealer script from the server “appleprocesshub[.]com” for exfiltration to the C2 server. Researchers from Nextron and Kandji have shared insights into these malware operations, highlighting the evolving tactics of threat actors in distributing and executing malicious code.
Source link