A new malware called Ov3r_Stealer was found to be intended for stealing cryptocurrency wallets and passwords and then sending them to a Telegram channel that the threat actor maintains.
Identified early in December, the malware was spread via a Facebook advertisement for an account manager position.
The user was directed via weaponized links to a malicious Discord content delivery URL, which triggered the attack’s execution phase.
“The malware is designed to exfiltrate specific types of data such as GeoLocation (based on IP), hardware info, passwords, cookies, credit card information, auto-fills, browser extensions, crypto wallets, Office documents, and antivirus product information,” SpiderLabs shared with Cyber Security News.
Document
@import url('https://fonts.googleapis.com/css2?family=Poppins&display=swap');
@import url('https://fonts.googleapis.com/css2?family=Poppins&family=Roboto&display=swap');
*{
margin: 0; padding: 0;
text-decoration: none;
}
.container{
font-family: roboto, sans-serif;
width: 90%;
border: 1px solid lightgrey;
padding: 20px;
background: linear-gradient(2deg,#E0EAF1 100%,#BBD2E0 100%);
margin: 20px auto ;
border-radius: 40px 10px;
box-shadow: 5px 5px 5px #e2ebff;
}
.container:hover{
box-shadow: 10px 10px 5px #e2ebff;
}
.container .title{
color: #015689;
font-size: 22px;
font-weight: bolder;
}
.container .title{
text-shadow: 1px 1px 1px lightgrey;
}
.container .title:after {
width: 50px;
height: 2px;
content: ' ';
position: absolute;
background-color: #015689;
margin: 20px 8px;
}
.container h2{
line-height: 40px;
margin: 2px 0;
font-weight: bolder;
}
.container a{
color: #170d51;
}
.container p{
font-size: 18px;
line-height: 30px;
}
.container button{
padding: 15px;
background-color: #4469f5;
border-radius: 10px;
border: none;
background-color: #00456e ;
font-size: 16px;
font-weight: bold;
margin-top: 5px;
}
.container button:hover{
box-shadow: 1px 1px 15px #015689;
transition: all 0.2S linear;
}
.container button a{
color: white;
}
hr{
/ display: none; /
}
Run Free ThreatScan on Your Mailbox
AI-Powered Protection for Business Email Security
Trustifi’s Advanced threat protection prevents the widest spectrum of sophisticated attacks before they reach a user’s mailbox. Try Trustifi Free Threat Scan with Sophisticated AI-Powered Email Protection .
Run Free Threat Scan
Facebook Ads Delivering Password Stealing Malware
A weaponized PDF file is used for the malware’s first access and transmission. The file impersonates a shared file on OneDrive. A simple clickable OneDrive link was found on a fake Facebook profile purporting to be Amazon CEO Andy Jassy.
Another instance was seen applying for a Digital Advertising position through a Facebook advertisement.
Facebook ad for a job in Digital Advertising
Upon selecting the “Access Document” link on the Facebook page, a file ending in .url is downloaded to initiate the subsequent phase.
SpiderLabs at Trustwave found a quicker way to reach the [.url] in the job notification for “pink women’s magazine” on Facebook by utilizing the PDF file’s information.
The malware was downloaded in three files from a GitHub site utilizing a Powershell script that was run in the victim’s environment and pretended to be Windows Control Panel binary.
Researchers observed additional ways to install the malware onto the system throughout the malware family study. These methods included HTML smuggling, SVG smuggling, and LNK file masquerading.
After the malware’s three files are loaded and launched on the system, a Scheduled Task is used as a persistence mechanism to make the malware run every ninety minutes.
After the data is acquired, it is exfiltrated to a Telegram channel that the threat actor monitors. All of this data might end up in the hands of the highest bidder, or the malware might modularize and then be used as a dropper for additional malware or post-exploit tools, all the way up to ransomware.
Researchers have found striking similarities between the Phemedrone stealer malware and the Ov3r_Stealer malware.
Given the latest reports of this malware, it’s possible that Phemedrone was repurposed and given the new name Ov3r_Stealer. Phemedrone is written in C#, which is the primary distinction between the two.
The team discovered numerous aliases, communication channels, and repositories during their frantic search for information on the threat actors. Aliases like “Liu Kong,” “MR Meta,” “MeoBlackA,” and “John Macollan” were discovered in forums like “Pwn3rzs Chat,” “Golden Dragon Lounge,” “Data Pro,” and “KGB Forums,” where a regular gathering of “researchers,” threat actors, and inquisitive people takes place.
Mitigation
Engage Security Awareness Programs
Regular Application and Service audits and baselining
Application patching
Run continuous Threat Hunting through your environments for undetected compromises.
The post Beware of Facebook Ads That Deliver Password-Stealing Malware appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform .
