Magnat campaigns use malvertising to deliver info stealer, backdoor and malicious Chrome extension

guest · Dec 6, 2021

Malicious Chrome Extension, Backdoor Uncovered in Malware Campaign
December 2, 2021

Researchers have detailed a threat actor, which they call Magnat, deploying a new backdoor and undocumented malicious Google Chrome extension in malware attacks that date back to 2018.

Magnat - a name that stems from the username in the build path of the campaign’s malware - has been using fake software installers as a lure to convince users to execute malware on their system, with filenames that include viber-25164.exe and wechat-35355.exe. Researchers with Cisco Talos, on Thursday, said they believe that the threat actor is stealing credentials with the intent of selling them on underground forums.
Click to expand...

Researchers assessed that the campaign uses malvertising - the use of malicious advertisements, which typically occurs through injecting malicious code into ads - as an initial means to reach users who might be interested in downloading popular software. Most victims targeted have been in Canada, the U.S. and Australia, with about 50 percent of infections in Canada.
Click to expand...

Backdoor and Malicious Chrome Extension
Once run, the fake installers execute a loader (typically either an .exe or .iso file) that pretends to be a software installer. In reality, the loader creates several files and deploys various commands that lead to the execution of three malware components. One of these is a malicious Google Chrome extension, which researchers called “MagnatExtension.”

These include a keylogger that captures the keys typed by victims and a form grabber that retrieves credentials from web data forms. The extension also grabs screenshots of passwords and swipes browser cookies.
The campaign also utilizes a backdoor that researchers called “MagnatBackdoor.”
Click to expand...

Cisco Talos: Magnat campaigns use malvertising to deliver information stealer, backdoor and malicious Chrome extension

Talos recently observed a malicious campaign offering fake installers of popular software as bait to get users to execute malware on their systems.

This campaign includes a set of malware distribution campaigns that started in late 2018 and have targeted mainly Canada, along with the U.S., Australia and some EU countries.

Two undocumented malware families (a backdoor and a Google Chrome extension) are consistently delivered together in these campaigns.

An unknown actor with the alias "magnat" is the likely author of these new families and has been constantly developing and improving them.

The attacker's motivations appear to be financial gain from selling stolen credentials, fraudulent transactions and Remote Desktop access to systems.

Click to expand...

Log in or Sign up

Magnat campaigns use malvertising to deliver info stealer, backdoor and malicious Chrome extension

guest Guest

Log in or Sign up

Magnat campaigns use malvertising to deliver info stealer, backdoor and malicious Chrome extension

guest Guest

Useful Searches