McDonalds-Themed Facebook Ads Serve Up Banking Trojans

guest · Nov 19, 2019

McDonalds-Themed Facebook Ads Serve Up Banking Trojans
The malware has backdoor functionality and the ability to steal payment cards and credentials
November 19, 2019
https://threatpost.com/mcdonalds-facebook-ads-banking-trojans/150425/

The Mispadu banking trojan is using a McDonalds malvertising tactic to ultimately steal payment-card data and online banking information. Written in Delphi, Mispadu targets Brazil and Mexico, uses pop-up windows and contains backdoor functionality.

According to researchers at ESET, Mispadu spreads via email as well as sponsored advertisements on Facebook.
If someone clicks the ad, they’re taken to a phony McDonalds website with a button that says, “I want!/Generate coupon.” Clicking this in turn downloads a ZIP archive to the victim machine containing an MSI installer, according to an analysis published on Tuesday.

“We believe this malware family is targeting the general public,” said the researchers. “Its main goals are monetary and credential theft.”
Click to expand...

The threat actors are abusing the Russian service Yandex.Mail to store the malicious payloads, according to the analysis: They likely sent themselves an email with the malicious coupon as an attachment, and then point potential victims to a direct link to this attachment.

In addition, it vacuums up credentials.

“The banking trojan executable comes with four potentially unwanted applications stored in its resource section,” researchers explained. “These applications are all otherwise legitimate files from Nirsoft, but have been patched to run from the command line with no GUI. [...]”
Click to expand...

ESET: Mispadu: Advertisement for a discounted Unhappy Meal

Log in or Sign up

McDonalds-Themed Facebook Ads Serve Up Banking Trojans

guest Guest

Log in or Sign up

McDonalds-Themed Facebook Ads Serve Up Banking Trojans

guest Guest

Useful Searches