Nasty malware abuses Microsoft e-signature service to steal your passwords
ZLoader malware is making a comeback
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
A well-knownmalwareis making new rounds online, abusingMicrosoft’s digital signature verification to steal passwords and other sensitive information from its victims.
According to cybersecurity researchers from Check Point Research (CPR), who spotted the new campaign, the ZLoader malware was most recently used to distribute theConti ransomwareseveral months ago.
This time around, however, ZLoader is the final payload, while the goal of the campaign is to steal sensitive data, not encrypt the devices.
Sneaky insertion
The distribution process is nothing out of the ordinary, CPR explains. First, the victim installs a remote management program “pretending to be a Java installation” when, in fact, it grants the attackers full access to the system, and allows them to upload and download files, as well as run scripts.
The attackers then “upload and run a few scripts, that download more scripts that run mshta.exe with file appContrast.dll as the parameter”.
The file appContrast.dll is signed by Microsoft, even though more information has been added to the end of the file, CPR explains, adding that this added information downloads and runs the final ZLoad payloader which steals passwords and other sensitive data.
Thousands of victims
CPR claims that the malware had been installed on more than 2,000 devices across 111 countries, with the majority of victims being in the United States, Canada, and India.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
CPR believes that the cybercrime group behind the campaign is called MalSmoke, “given a few similarities with previous campaigns”, it said.
“We first began seeing evidence of the new campaign around November 2021,” said Kobi Eisenkraft, Malware Researcher at Check Point. “All in all, it seems like the Zloader campaign authors put great effort intodefenseevasion and are still updating their methods on a weekly basis. I strongly urge users to apply Microsoft’s update for strict Authenticode verification, It is not applied by default.”
Besides applying Microsoft’s update for strict Authenticode verification, which is not applied by default, Check Point Research also reminds everyone to be mindful when installing programs from unknown sources or sites. And finally, to be vigilant when clicking on links or opening email attachments, as these are often malicious.
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
Cisco issues patch to fix serious flaw allowing possible industrial systems takeover
Washington state court systems taken offline following cyberattack
Sihoo Doro S100 ergonomic office chair review
