Beware: Fake Browser Updates Deliver BitRAT and Lumma Stealer Malware

Faux web browser updates are currently being made use of to deliver remote accessibility trojans (RATs) and information stealer malware these as BitRAT and Lumma Stealer (aka LummaC2).

“Faux browser updates have been accountable for various malware infections, including those of the very well-identified SocGholish malware,” cybersecurity company eSentire claimed in a new report. “In April 2024, we noticed FakeBat staying dispersed by means of related fake update mechanisms.”

The attack chain commences when potential targets visits a booby-trapped website that consists of JavaScript code built to redirect buyers to a bogus browser update website page (“chatgpt-app[.]cloud”).

The redirected web website page arrives embedded with a obtain backlink to a ZIP archive file (“Update.zip”) that’s hosted on Discord and downloaded immediately to the victim’s device.

It’s truly worth pointing out that risk actors frequently use Discord as an attack vector, with a modern analysis from Bitdefender uncovering much more than 50,000 perilous one-way links distributing malware, phishing strategies, and spam above the earlier six months.

Existing inside the ZIP archive file is another JavaScript file (“Update.js”), which triggers the execution of PowerShell scripts accountable for retrieving extra payloads, which include BitRAT and Lumma Stealer, from a remote server in the type of PNG graphic information.

Also retrieved in this method are PowerShell scripts to establish persistence and a .NET-based mostly loader which is largely employed for launching the closing-stage malware. eSentire postulated that the loader is most likely advertised as a “malware shipping and delivery company” owing to the reality that the identical loader is employed to deploy each BitRAT and Lumma Stealer.

BitRAT is a characteristic-loaded RAT that makes it possible for attackers to harvest information, mine cryptocurrency, download more binaries, and remotely commandeer the infected hosts. Lumma Stealer, a commodity stealer malware available for $250 to $1,000 per month given that August 2022, gives the potential to seize details from web browsers, crypto wallets, and other delicate information.

“The fake browser update lure has become widespread among attackers as a means of entry to a unit or network,” the company explained, including it “shows the operator’s skill to leverage dependable names to optimize reach and impact.”

Though this sort of assaults normally leverage push-by downloads and malvertising methods, ReliaQuest, in a report revealed previous week, reported it uncovered a new variant of the ClearFake campaign that methods users into copying, pasting, and manually executing destructive PowerShell code less than the pretext of a browser update.

Especially, the malicious web page statements that “some thing went wrong though displaying this webpage” and instructs the website customer to set up a root certificate to deal with the issue by subsequent a collection of actions, which includes copying obfuscated PowerShell code and running it in a PowerShell terminal.

“Upon execution, the PowerShell code performs numerous functions, together with clearing the DNS cache, displaying a information box, downloading even more PowerShell code, and putting in ‘LummaC2’ malware,” the business claimed.

In accordance to data shared by the cybersecurity agency, Lumma Stealer emerged as just one of the most widespread details stealers in 2023, along with RedLine and Raccoon.

“The quantity of LummaC2-attained logs shown for sale elevated by 110% from Q3 to Q4 2023,” it noted. “LummaC2’s climbing reputation amid adversaries is probably thanks to its higher achievement price, which refers to its efficiency in properly infiltrating devices and exfiltrating sensitive info without detection.”

The development comes as the AhnLab Security Intelligence Heart (ASEC) disclosed details of a new campaign that employs webhards (limited for web challenging travel) as a conduit to distribute malicious installers for grownup game titles and cracked versions of Microsoft Workplace and ultimately deploy a selection of malware these as Orcus RAT, XMRig miner, 3proxy, and XWorm.

Equivalent attack chains involving internet sites offering pirated software have led to the deployment of malware loaders like PrivateLoader and TaskLoader, which are each available as a pay out-for every-set up (PPI) company for other cybercriminals to deliver their possess payloads.

It also follows new results from Silent Press about CryptoChameleon’s “just about exclusive use” of DNSPod[.]com nameservers to assistance its phishing kit architecture. DNSPod, portion of the Chinese organization Tencent, has a heritage of furnishing products and services for destructive bulletproof hosting operators.

“CryptoChameleon utilizes DNSPod nameservers to interact in quick flux evasion methods that let risk actors to speedily cycle as a result of significant quantities of IPs joined to a solitary domain identify,” the business said.

“Rapid flux makes it possible for CryptoChameleon infrastructure to evade classic countermeasures, and substantially lessens the operational value of legacy point-in-time IOCs.” using at least seven key social media accounts and a CIB network of additional than 250 accounts.

Uncovered this posting interesting? Observe us on Twitter  and LinkedIn to examine more exceptional information we article.

Some parts of this article are sourced from:
thehackernews.com