Our Security Researcher Michael Steele @crimewaretech delved deeply into ScamClub landing pages and the platforms with which ScamClub is affiliated!
https://t.co/9gKT2yv8hP
Fake "Monkey Drainer" leak on @github targets wannabe #Web3 Scammers with a Raccoon Stealer!
https://t.co/AQzwfo5ads
c2: 193.37.213.23
As crypto-drainers gain popularity, we see more and more backdoored or malicious codebases targeting would-be thieves.
Malvertisers love to abuse low-impact browser bugs. They're often slow to get patched and make a significant impact on the efficacy of their malicious campaigns.
https://t.co/JQmhrjHQIW
In late September '22 we found a fun little browser bug impacting WebKit that was being abused by a malvertiser. Write up coming soon™️ on the @ConfiantIntel blog.
This campaign was identified targeting Brazil.
The .msi installer drops the following files inside %APPDATA% in a directory named “xxasd” that have the following structure. The extension is side loaded in it’s unpacked form below, into chrome via the --load-extension= switch.
Warning 🚨: Google Search Ads delivering Malicious Chrome Extension 👾
Teamviewer search ads results pointing to a malicious domain: website-montppio24[.]buzz enabling drive-by downloads delivering an .MSI installer which in turn installs the extension 🧵
The extension monitors this list of domains in order to steal user credentials, sessions or hijack the transmitted data between the victims and the monitored domains.
The extension exchanges the stolen data encrypted, with a C2 server -> mudg4rzhrmbjdcg0.ads798ad[.]top
Here’s a great write-up by Billy Hurley in IT Brew on Daniel Fonseca Yarochewsky, Confiant security software engineer’s article uncovering how CashRewindo threat actors use aged domains to serve malicious ads.
https://t.co/Vx46xFTYAL
This domain could be originating from multiple sources: Google search ads (highly likely since the malware delivery 100% overlaps with multiple malicious domains delivered via Google search ads), but could be also phishing or email etc.
This new domain:
/MALWAREBYTES-PREMIUM[.]COM
Creation Date: 2023-01-18T09:37:43Z
🧩Distributes a file:
>zip with a ~800Mo exe
>Fake cert
☣️Probably a stealer (#Vidar or #Mars)
/65.109.208[.]140/pack[.]zip
/116.203.30[.]135/qthw6l/rpilag[.]exe
@malwrhunterteam@hasherezade