Bogus software program replace lures are being utilized by risk actors to ship a brand new stealer malware referred to as CoinLurker.
“Written in Go, CoinLurker employs cutting-edge obfuscation and anti-analysis techniques, making it a highly effective tool in modern cyber attacks,” Morphisec researcher Nadav Lorber mentioned in a technical report revealed Monday.
The assaults make use of faux replace alerts that make use of numerous misleading entry factors akin to software program replace notifications on compromised WordPress websites, malvertising redirects, phishing emails that hyperlink to spoofed replace pages, pretend CAPTCHA verification prompts, direct downloads from phoney or contaminated websites, and hyperlinks shared through social media and messaging apps.
Whatever the technique utilized to set off the an infection chain, the software program replace prompts make use of Microsoft Edge Webview2 to set off the execution of the payload.
“Webview2’s dependency on pre-installed components and user interaction complicates dynamic and sandbox analysis,” Lorber mentioned. “Sandboxes often lack Webview2 or fail to replicate user actions, allowing the malware to evade automated detection.”
One of many superior ways adopted in these campaigns considerations using a way referred to as EtherHiding, during which the compromised websites are injected with scripts which are designed to succeed in out to Web3 infrastructure with a view to retrieve the ultimate payload from a Bitbucket repository that masquerades as authentic instruments (e.g., “UpdateMe.exe,” “SecurityPatch.exe”).
These executables, in flip, are signed with a legitimate-but-stolen Prolonged Validation (EV) certificates, thereby including one other layer of deception to the scheme and bypassing safety guardrails. Within the remaining step, the “multi-layered injector” is used to deploy the payload into the Microsoft Edge (“msedge.exe”) course of.
CoinLurker additionally makes use of a intelligent design to hide its actions and complicate evaluation, together with heavy obfuscation to test if the machine is already compromised, decoding the payload immediately in reminiscence throughout runtime, and taking steps to obscure this system execution path utilizing conditional checks, redundant useful resource assignments and iterative reminiscence manipulations.
“This approach ensures that the malware evades detection, blends seamlessly into legitimate system activity, and bypasses network security rules that rely on process behavior for filtering,” Morphisec famous.
CoinLurker, as soon as launched, initiates communications with a distant server utilizing a socket-based strategy and proceeds to reap information from particular directories related to cryptocurrency wallets (particularly, Bitcoin, Ethereum, Ledger Stay, and Exodus), Telegram, Discord, and FileZilla.
“This comprehensive scanning underscores CoinLurker’s primary goal of harvesting valuable cryptocurrency-related data and user credentials,” Lorber mentioned. “Its targeting of both mainstream and obscure wallets demonstrates its versatility and adaptability, making it a significant threat to users in the cryptocurrency ecosystem.”
The event comes as a single risk actor has been noticed orchestrating as many as 10 malvertising campaigns that abuse Google Search advertisements to single out graphic design professionals since a minimum of November 13, 2024, utilizing lures associated to FreeCAD, Rhinoceros 3D, Planner 5D, and Onshape.
“Domains have been launched day after day, week after week, since at least November 13, 2024, for malvertising campaigns hosted on two dedicated IP addresses: 185.11.61[.]243 and 185.147.124[.]110,” Silent Push mentioned. “Sites stemming from these two IP ranges are being launched in Google Search advertising campaigns, and all lead to a variety of malicious downloads.”
It additionally follows the emergence of a brand new malware household dubbed I2PRAT that abuses the I2P peer-to-peer community for encrypted communications with a command-and-control (C2) server. It is value noting that I2PRAT can also be tracked by Cofense beneath the identify I2Parcae RAT.
The start line of the assault is a phishing e-mail containing a hyperlink that, when clicked, directs the message recipient to a pretend CAPTCHA verification web page, which employs the ClickFix approach to trick customers into copying and executing a Base64-encoded PowerShell command answerable for launching a downloader, which then deploys the RAT after retrieving it from the C2 server over a TCP socket.
