- Microsoft says it discovered a large malvertising -campaign
- The goal was to insert infostealers as wide as possible
- The company removed a non -publicly made number of github -stocks in response
More than a million PCs have been infected by Infostealers through a massive malvertising campaign, new research from Microsoft’s security researchers has revealed.
The campaign starts at illegal streaming venues where people can see pirated content. Apparently, cyber criminal ads in these videos sent visitors through a roller coaster with redirections before landing on one of many GitHub stocks under strikers’ control.
There, they would download the first payload that would run system discovery and collect system information (operating system data, screen resolution, memory size, etc.), performing it to a server under strikers’ control while implementing the utility stage’s payload.
Infostealers in action
Utility stage payload depends on the compromised device. In some cases, it will be a net support Remote Access Trojan (Rat), followed by Lumma Stealer or Doerium InfoSteals. This malware can get hold of people’s login credentials, cryptocurrency information, bank information and more. In other cases, Malware downloads an executable file that runs a CMD and releases a renamed Autoit -Tolk with a .com extension.
Autoit then runs a few additional steps that eventually lead to the same result – exfiltration of sensitive files from the target system.
In most cases, the payloads were hosted at GitHub, and Microsoft said it took a non -public number of storage places. However, Malware also hosted Dropbox and Discord. It does not attribute the campaign to any particular threat actor and said the victims were found in a large number of industries.
“This activity is traced under the paraplyn name Storm-0408, which we use to track several threat actors associated with remote access or information-stubborn malware, using phishing, search engine optimization (SEO) or malvertising campaigns to distribute malicious payload,” Microsoft said.
“The campaign affected a wide range of organizations and industries, including both consumer and business units that highlighted the arbitrary nature of the attack.”
Via Bleeping computer
