Backdoor malware is being spread through fake security certificate alerts

guest · Mar 5, 2020

Backdoor malware is being spread through fake security certificate alerts
Victims of this new technique are invited to install a malicious "security certificate update"
March 5, 2020
https://www.zdnet.com/article/backd...ead-through-fake-security-certificate-alerts/

Backdoor and Trojan malware variants are being distributed through a new phishing technique that attempts to lure victims into accepting an "update" to website security certificates.

[...] a new phishing approach is now abusing the certificate trust mechanism.
On Thursday, cybersecurity researchers from Kaspersky reported that the new technique has been spotted on a variety of websites, ranging from a zoo to an e-commerce store selling vehicle parts. The earliest infections date back to January 16, 2020.

The alert claims the website's security certificate is out of date, but rather than this being the domain owner's problem, victims are urged to install a "security certificate update" to proceed.
The message is contained within an iframe and content is loaded via a jquery.js [...]

"The jquery.js script overlays an iframe that is exactly the same size as the page," the researchers say. "As a result, instead of the original page, the user sees a seemingly genuine banner urgently prompting to install a certificate update."
When unpacked and installed, the executable will deliver one of two malware variants to the victim, either Mokes or Buerak.
Click to expand...

Mokes is a macOS/Windows backdoor, deemed "sophisticated" by the cybersecurity firm, which is able to execute code, take screenshots, steal PC information including files, audio, and video captures; install a backdoor for persistence, and use AES-256 encryption to disguise its activities.

In comparison, Buerak is a Windows-based Trojan able to execute code, tamper with running processes, steal content, maintain persistence through registry keys, and detect various analysis and sandboxing techniques.
Click to expand...

Kaspersky: Mokes and Buerak distributed under the guise of security certificates

Log in or Sign up

Backdoor malware is being spread through fake security certificate alerts

guest Guest

Log in or Sign up

Backdoor malware is being spread through fake security certificate alerts

guest Guest

Useful Searches