MosaicLoader Malware Delivers Facebook Stealers, RATs

guest · Jul 20, 2021

New MosaicLoader malware targets software pirates via online ads
July 20, 2021
https://www.bleepingcomputer.com/ne...ware-targets-software-pirates-via-online-ads/

An ongoing worldwide campaign is pushing new malware dubbed MosaicLoader advertising camouflaged as cracked software via search engine results to infect wannabe software pirates' systems.

MosaicLoader is a malware downloader designed by its creators to deploy more second-stage payloads on infected systems, as Bitdefender researchers revealed in a report published today and shared with BleepingComputer last week.

"We named it MosaicLoader because of the intricate internal structure that aims to confuse malware analysts and prevent reverse-engineering," Janos Gergo Szeles, Senior Security Researcher at Bitdefender, revealed.
The researcher added that the campaign doesn't target a specific region. Due to its online advertising lures, it will attempt to infect any search engine users looking to download and install cracked software installers on their devices.
Click to expand...

The attackers are camouflaging their droppers as executables belonging to legitimate software, using similar icons and including info such as company names and descriptions within the files' metadata info to pass superficial scrutiny.

After being deployed on a victim's system, MosaicLoader downloads additional malware ranging from cryptocurrency miners and cookie stealers to Remote Access Trojans (RATs) and backdoors using "a complex chain of processes."
Click to expand...

To add to the danger of getting your system infected with MosaicLoader, the threat actors (or their clients) can harvest sensitive info such as credentials from compromised systems using RATs and similar malware with data theft capabilities.
Click to expand...

Bitdefender: "Debugging MosaicLoader, One Step at a Time"
(PDF): https://www.bitdefender.com/files/News/CaseStudies/study/400/Bitdefender-PR-Whitepaper-MosaicLoader-creat5540-en-EN.pdf

guest · Jul 20, 2021

MosaicLoader Malware Delivers Facebook Stealers, RATs
The newly documented code is a full-service malware-delivery threat that’s spreading indiscriminately globally through paid search ads
July 20, 2021
https://threatpost.com/mosaicloader-malware-facebook-stealers/167939/

A never-before-documented Windows malware strain dubbed MosaicLoader is spreading worldwide, acting as a full-service malware-delivery platform that’s being used to infect victims with remote-access trojans (RATs), Facebook cookie stealers and other threats.

Researchers observed the malware sprayer delivering Facebook cookie stealers, which exfiltrate login data – this allows cyberattackers to take over accounts, create posts that spread malware or those that cause reputational damage.
MosaicLoader is also spreading the Glupteba backdoor and a variety of RATs for espionage purposes, they said, which can log keystrokes, record audio from the microphone and images from the webcam, capture screenshots and so on. Other observed threats so far include cryptocurrency miners, they said.
Click to expand...

How to Protect Against MosaicLoader
“Systems infected with this malware become part of the network of machines that attackers can further infect with any piece of malware they want,” warned researchers.

The best way to defend against MosaicLoader is to avoid downloading cracked software from any source, since that’s the initial infection vector (for now). Users should also check the source domain of every download to make sure that the files are legitimate and keep security solutions up-to-date, researchers recommended.
Click to expand...

xxJackxx · Jul 27, 2021

I've seen articles that claim this thing sets up exclusions for itself for Windows Defender.
https://thehackernews.com/2021/07/this-new-malware-hides-itself-among.html

Log in or Sign up

MosaicLoader Malware Delivers Facebook Stealers, RATs

guest Guest

guest Guest

xxJackxx Registered Member

Log in or Sign up

MosaicLoader Malware Delivers Facebook Stealers, RATs

guest Guest

guest Guest

xxJackxx Registered Member

Useful Searches