Hackers Trick Users with Fake Windows 11 Downloads to Distribute Vidar Malware

Fraudulent domains masquerading as Microsoft’s Windows 11 obtain portal are making an attempt to trick end users into deploying trojanized installation data files to infect devices with the Vidar data stealer malware.

“The spoofed web-sites have been created to distribute destructive ISO data files which direct to a Vidar data-stealer an infection on the endpoint,” Zscaler mentioned in a report. “These variants of Vidar malware fetch the C2 configuration from attacker-controlled social media channels hosted on Telegram and Mastodon network.”

Some of the rogue distribution vector domains, which ended up registered previous month on April 20, consist of ms-gain11[.]com, get11-serv[.]com, and get11install[.]com, and ms-teams-application[.]net.

In addition, the cybersecurity organization cautioned that the risk actor behind the impersonation campaign is also leveraging backdoored versions of Adobe Photoshop and other reputable program these as Microsoft Groups to deliver Vidar malware.

The ISO file, for its component, has an executable which is unusually substantial in sizing (above 300MB) in an endeavor to evade detection by security options and is signed with an expired certification from Avast that was most likely stolen next the latter’s breach in Oct 2019.

But embedded within just the 330MB binary is a 3.3MB-sized executable which is the Vidar malware, with the relaxation of the file material padded with 0x10 bytes to artificially inflate the size.

In the subsequent stage of the attack chain, Vidar establishes connections to a distant command-and-handle (C2) server to retrieve respectable DLL information such as sqlite3.dll and vcruntime140.dll to siphon valuable facts from compromised systems.

Also noteworthy is the abuse of Mastodon and Telegram by the menace actor to retail outlet the C2 IP address in the description subject of the attacker-managed accounts and communities.

The results incorporate to a listing of various approaches that have been uncovered in the past month to distribute the Vidar malware, like Microsoft Compiled HTML Assist (CHM) information and a loader called Colibri.

“The menace actors distributing Vidar malware have demonstrated their capacity to social engineer victims into installing Vidar stealer employing themes associated to the most current well known application applications,” the researchers said.

“As usually, customers need to be cautious when downloading software apps from the Internet and down load software program only from the official seller internet websites.”

Discovered this write-up fascinating? Abide by THN on Facebook, Twitter  and LinkedIn to read through additional special information we publish.

Some parts of this article are sourced from:
thehackernews.com