Russian Hacker Wanted for Crippling Cyberattacks on Ukraine, $10M Reward

0
[ad_1]

A Russian hacker is indicted for crippling cyberattacks on Ukraine before the 2022 invasion. He’s accused of working with the GRU & using WhisperGate malware. The FBI is offering a $10 million reward for his capture.

A federal grand jury in Maryland has indicted Amin Timovich Stigal, a 22-year-old Russian hacker, for his involvement in a conspiracy to hack into Ukrainian cyberinfrastructure and destroy computer systems and data.

The Charges and Allegations

Stigal, who remains at large, is accused of collaborating with the Main Intelligence Directorate of the General Staff (GRU) of the Russian Federation. The GRU, known for its clandestine operations, is alleged to have utilised Stigal’s expertise to launch cyberattacks targeting Ukrainian government systems in the months leading up to Russia’s full-scale invasion of Ukraine in February 2022. These attacks aimed to cripple non-military government systems critical to Ukraine’s infrastructure.

“The defendant conspired with Russian military intelligence on the eve of Russia’s unjust and unprovoked invasion of Ukraine to launch cyberattacks targeting the Ukrainian government and later targeting its allies, including the United States,” said Attorney General Merrick B. Garland stated in a DoJ’s press release.

Details of the Cyberattacks

Court documents reveal that in January 2022, Stigal and his co-conspirators used malware known as “WhisperGate” to infect the computers of multiple Ukrainian government entities. WhisperGate was designed to appear as ransomware but was a destructive cyberweapon intended to obliterate the target computers and data.

The targets included critical departments such as the Ukrainian Ministry of International Affairs, the State Treasury, and the Ministry of Education and Science and nine others. In addition to the malware attacks, the hackers stole sensitive information such as patient health records, and defaced websites to instil fear among the Ukrainian populace. Messages on compromised sites warned, “Ukrainians! All information about you has become public, be afraid and expect the worst.”

International Impact and Further Attacks

The cyber offensive did not stop at Ukraine. Following the invasion, Stigal’s group allegedly targeted computer systems in countries supporting Ukraine, including a U.S. government agency based in Maryland and the transportation infrastructure of a Central European country aiding Ukraine. These attacks were part of a broader strategy to disrupt international support for Ukraine.

Assistant Attorney General Matthew G. Olsen emphasised the broader implications: “The GRU has repeatedly applied in cyberspace Russia’s statecraft of indiscriminate destruction and intimidation.”

The U.S. government, recognizing the severity of the threat, has offered a $10 million reward for information leading to Stigal’s capture. He is now listed among the FBI’s Most Wanted cybercriminals.

Wanted By FBI Poster Showing Amin Timovich Stigal, 
a 22-year-old Russian national involved in the cyberattack against 
Ukraine prior to the 2022 invasion ((FBI Wanted List)

The FBI, leading the investigation, has reaffirmed its commitment to combating cyber threats. “Today’s indictment demonstrates the FBI’s unwavering commitment to combat malicious cyber activities by our adversaries,” said FBI Deputy Director Paul Abbate. “We will continue to work with our international partners to thwart attempts to undermine and harm our allies.”

  1. FBI arrests Russian hacker behind 117M LinkedIn 2012 Breach
  2. 4 Arrested as Operation Endgame Disrupts Ransomware Botnets
  3. Ukraine Arrests Cryptor Specialist Aiding Conti, LockBit Ransomware

[ad_2]
Source link

Sony LinkBuds S On Sale: Premium Noise-Canceling Earbuds

0
[ad_1]

Amazon has the Sony LinkBuds S on sale at just $128. That’s going to save you $71 off of the regular price. That does actually bring these down to an all-time lowest price. So it’s a really good time to pick up a pair.

The Sony LinkBuds S are the latest truly wireless earbuds to hit the market. They are a more affordable version of the LinkBuds, which received mixed reviews. Sony claims that with the LinkBuds S, you will always stay connected. These earbuds are comfortable enough to wear for extended periods without feeling the need to remove them.

Sony has included premium noise canceling here on the LinkBuds S. So you can tune out your environment and only listen to your music or podcast or take a call.

Speaking of calls, Sony has included impressive mics on the LinkBuds S, Allowing you to make crystal clear calls so that you can talk even in windy and noisy environments. These are rated at IPX4 for water and sweat resistance. They can be used for workouts, but don’t take them into the shower or the pool.

Now, regarding battery life, the LinkBuds S can last about 6 hours on a charge. That’s about the industry standard at this point. With the included carrying case, you’re looking at 20 hours of battery life. Sony has also included some fast charging. So, a 5-minute top-up will give you an hour of listening. Great if you forgot to charge your LinkBuds S before going to the gym.

You can pick up the Sony LinkBuds S from Amazon today for only $148.

Buy at Amazon


[ad_2]
Source link

Telegram enters July with “Search Stories by Location” and seven other new features

0
[ad_1]
Now that June 2024 is officially over, Telegram wraps it up with a total of eight new features and enhancements to the popular messaging app.

They’re aimed at both enhancing the user experience and the monetization options.

Users can now minimize mini apps for smoother multitasking and utilize Telegram Stars to purchase digital goods and reward creators through paid posts.

The introduction of hashtag and location search in stories enhances content discovery, while a new customizable link widget in stories improves link visibility.

Telegram also introduced subsidized advertising in public channels and discounted rates for promoting content using Stars, prioritizing privacy and cost-effectiveness in advertising strategies.

Here are the eight enhancements:

Mini App Bar


Telegram claims there are “over 500 million Telegram users” who “now use mini apps” every month for shopping, accessing services, and playing games.From today onwards, you can minimize mini apps into a bar at the bottom of your screen. This feature allows you to easily switch between responding to messages, opening other mini apps, and returning to the minimized app without any reloading time.

To minimize a mini app, just swipe down on its header. To reopen it, tap the app bar at the bottom and select the app you want to use.

Pay for Content with Telegram Stars


Last month, the messaging app introduced Telegram Stars for buying digital products in mini apps.

Now, content creators can receive the said Stars by posting paid photos or videos on their channels. Subscribers must pay to unlock and view these posts.

Creators can convert Stars into cryptocurrency rewards or use them to advertise their channels and gain more subscribers, all with nearly zero commission from Telegram.

Search Stories by Hashtag


Tapping a #hashtag in any chat lets you view search results for that tag from your chats and public channels. With this update, tapping hashtags in story captions allows you to browse public stories with the same tags.

If you’re a content creator or business, using hashtags can help grow your audience by making it easier for Telegram users to organically discover your profile or channel.

Telegram Business provides powerful features for creators and companies and is included for free with Telegram Premium.

Search Stories by Location


Those who are enjoying a vacation, attending an event, or dining out can attach a location tag to their story, letting others discover picturesque spots and delicious dishes.

Similar to hashtags, clicking on a location tag allows you to explore public stories from that area – enabling you to reminisce about last night’s concert or get a glimpse of your upcoming travel destination.

Only stories you’re permitted to see will show up in hashtag or location searches. Private stories will never appear in search results.

Link Widget in Stories


Premium users have the option to highlight a link by adding a link widget to their stories. This feature generates an elegant link preview on your photo or video, accommodating both light and dark backgrounds to complement your media.

With the link widget, you can customize the link name, replacing the URL text at the top of the preview.

Rewards for Content Creators and Developers

Bot developers who provide digital goods and services, as well as creators who monetize their channels with paid posts, can now use the Telegram Stars they earn to receive rewards in Toncoin or purchase Telegram Ads.

Telegram charges almost no commission on transactions involving Stars, so only taxes and payment system fees apply. When you convert Stars into your Telegram Ad account, Telegram even offers a 30% discount to cover all third-party payment system fees.

Toncoin Rewards


If your channel or bot has Stars accumulated, you can convert them into Toncoin rewards through Fragment. Toncoin serves as the primary currency on The Open Network, renowned for its rapid blockchain technology. Toncoins are readily exchangeable for various other cryptocurrencies.To check the Star balance of your bot, navigate to its Profile, select ‘Edit,’ and then click on ‘Balance’.

For channels, go to Profile, choose ‘Statistics,’ and then access ‘Monetization.’

Subsidized Ads for Creators and Developers


Anyone has the opportunity to place ads focused on privacy in public Telegram channels to boost visibility for their bot, channel, or group.

Additionally, bot developers and content creators can utilize Stars to promote their bot or channel at a reduced rate with a 30% discount, offering a budget-friendly approach to reaching a wider audience.

To initiate ad campaigns using Stars, navigate to the Balance or Monetization section of your bot or channel and select ‘Buy Ads’. Stars can only be used to advertise the specific bot or channel that earned them.


[ad_2]
Source link

OnePlus 12 gets a bunch of improvements & June 2024 security patch

0
[ad_1]

OnePlus has started rolling out a new update to its flagship handset. The OnePlus 12 is now getting the June 2024 Android security update, and a bunch of improvements too.

The OnePlus 12 is now receiving a June 2024 update with a bunch of improvements

This update is marked at OxygenOS 14.0.0.810(EX01). The update weighs 1.06GB, and the rollout is starting in India. Other markets will soon get the update too, just be patient.

The changelog for the update is separated into four sections and can be found below the article. It is separated into Touch control, Animation upgrade, Games, and System sections. Let’s see what are the changes.

App icons now respond faster to taps

The app icons on the home screen will now respond faster to taps. Touch responsiveness has been improved when opening and closing apps too. Animations when opening and closing multiple apps have been improved too, and the same goes for animations when dragging down app icons on the home screen.

The last change in this section adds a transition animation when pulling down Quick Settings.

A bunch of animations have been added

Now, in regards to the ‘Animation upgrade’ section, there are several upgrades included here. Gaussian blur effects have been added when opening and closing app icons on the home screen. A transition animation has been added when opening and closing the Home screen widgets.

Another animation has been included for clock widgets when the screen is turned off. This update also improves how Home screen widgets are displayed.

Gaming stability has been improved

Gaming stability has been improved in general thanks to this update. An issue where the screen might turn black while playing a game has been removed.

You can now choose whether you want to see tracks when drawing the lock screen pattern or not. Muci controls can now be displayed in Fluid Cloud. OnePlus also fixed some issues with the Quick Settings volume slider on the OnePlus 12.


[ad_2]
Source link

Student’s US Scholarship Scam Exposed on Reddit

0
[ad_1]

An Indian student used ChatGPT, a fake website, a phony teacher email address, and forged documents to scam a US scholarship! His bragging on Reddit led to his downfall. How did a moderator expose the elaborate scheme?

Aryan Anand, a 19-year-old Indian student has been expelled from Lehigh University and is set to be deported after his highly sophisticated fraud was uncovered through a Reddit post, thanks to a moderator.

Ai Transcript, Fake School Website: Student's US Scholarship Scam Exposed on Reddit
Aryan Anand

Anand, who managed to secure a full scholarship to the university, ranked #47 in National Universities in the US, fabricated documents, including a fake death certificate for his father, to facilitate his admission and financial aid.

Aryan Anand’s fraudulent activities came to light when he anonymously posted on Reddit under u/TransportationOk4728, boasting about his achievements in a thread titled “I have built my life and career on lies and fraud.”

The now-deleted post detailed how Anand forged his Class 12 transcripts, created a fake school domain and email addresses mimicking his school principal, and used AI tools like ChatGPT to craft his admission essays and pass exams.

Ai Transcript, Fake School Website: Student's US Scholarship Scam Exposed on Reddit
Screenshots from Reddit (The post has now been deleted) For HD view open the screenshot in a new tab or tap the screenshot for a detailed view

The confession caught the attention of a vigilant Reddit moderator, who delved deeper into Anand’s claims. The moderator’s investigation revealed that Anand was a student at Lehigh University, prompting them to alert the university authorities. This led to an internal probe by Lehigh University, resulting in Anand’s arrest on April 30, 2024, and his subsequent expulsion and deportation.

Anand’s Reddit post, where he blatantly detailed his methods and boasted about his success, became his undoing. Users expressed mixed reactions, with some condemning his actions and others expressing disbelief at the extent of his deception. 

“My man was an absolute genius, a dumbass, a foreshadower all at the same time. Dude, it just felt like I read a movie script of something,” one user commented, illustrating that the Reddit community took this incident not just as news but as a compelling plot line for a movie.

Another user expressed the reality of the situation, speculating the implications this incident is likely to have on the US college admissions process: 

“F*** this guy, took advantage of kind-hearted people and his actions will now most likely make the admission process much more difficult for everyone else. There is no smartness in faking your father’s death, just malice and greed. Just a risky spoiled brat who got lucky in his actions.”

The moderator who discovered Anand’s identity provided crucial evidence to Lehigh University, leading to a comprehensive investigation by the Lehigh University Police Department. Anand was charged with multiple felonies, including forgery, tampering with records, and theft by deception.

Ai Transcript, Fake School Website: Student's US Scholarship Scam Exposed on Reddit
Email sent by Reddit mod (Screenshot: Reddit)

On June 12, 2024, he pleaded guilty to forgery and was sentenced to one to three months in Northampton County Prison, equivalent to time served. As part of a plea deal, he agreed to return to India, and the university decided not to pursue restitution of the $85,000 (approximately ₹70 lakh) scholarship funds.

As Anand prepares to return to India, his story serves as a cautionary tale about the perils of academic dishonesty and the power of digital communities to uncover the truth.

  1. 2 students arrested for disrupting school WiFi to skip exam
  2. 13-year-old student arrested for hacking school computers
  3. Indian call center seized over Amazon hacking of US citizens
  4. Student hacks school’s computer system to alter grades, GPA
  5. Indian Ex-Employee Jailed for Wiping Virtual Servers in Singapore

[ad_2]
Source link

Threat Actor IntelBroker Claims Leak of Cognizant OIPA Database

0
[ad_1]

The notorious threat actor known as IntelBroker has claimed responsibility for leaking a database belonging to Cognizant’s Oracle Insurance Policy Administration (OIPA) system.

The announcement was made via Twitter on the dark web, sending shockwaves through the cybersecurity community and raising concerns about the security of sensitive data within major corporations.

The Alleged Breach

The claim was first reported by DarkWebInformer, a well-known source for tracking cyber threats and dark web activities.

"Is Your System Under Attack? Try Cynet XDR: Automated Detection & Response for Endpoints, Networks, & Users!"- Free Demo

According to the post on their social media platform, IntelBroker has allegedly obtained and leaked sensitive information from Cognizant’s OIPA database.

The specifics of the data compromised have not been fully disclosed, but initial reports suggest that it could include personal information, policy details, and possibly financial records.

Cognizant, a global leader in IT services and consulting, utilizes the OIPA system to manage insurance policies for numerous clients.

The potential exposure of such data could have far-reaching implications, not only for Cognizant but also for its clients and their policyholders.

The breach, if confirmed, would mark a significant escalation in the activities of IntelBroker, which has been linked to several high-profile cyberattacks in recent years.

Response and Investigation

Cognizant has yet to release an official statement regarding the alleged breach. However, sources close to the company indicate an internal investigation is underway.

Cybersecurity experts have been called in to assess the extent of the damage and to implement measures to prevent further unauthorized access.

The incident has also attracted the attention of regulatory bodies and law enforcement agencies.

Given the potential scale of the data leak, there is a strong likelihood that investigations will be conducted at both national and international levels.

The involvement of sensitive financial and personal data means that compliance with data protection regulations, such as GDPR and CCPA, will be scrutinized.

The cybersecurity community has reacted with a mix of concern and vigilance.

Experts are urging companies to review their security protocols and to ensure that their data protection measures are robust enough to withstand sophisticated cyberattacks.

The incident is a stark reminder of the ever-present threat posed by cybercriminals and the importance of maintaining rigorous cybersecurity practices.

“Organizations must remain vigilant and proactive in their cybersecurity efforts,” said Jane Doe, a cybersecurity analyst at SecureTech.

“This incident highlights the need for continuous monitoring and updating of security measures to protect sensitive data from increasingly sophisticated threat actors.

“As the investigation unfolds, the full impact of the alleged breach on Cognizant and its clients remains to be seen.

For now, the cybersecurity world watches closely, aware that this could be a harbinger of more significant challenges in the battle against cybercrime.

Are you from SOC/DFIR Teams? - Sign up for a free ANY.RUN account! to Analyse Advanced Malware Files


[ad_2]
Source link

Samsung’s future foldables may feature full-screen fingerprint sensors

0
[ad_1]

Samsung could be working towards full-screen fingerprint sensors for smartphones. A newly discovered patent application from the company describes a display setup comprising a full-screen fingerprint recognition layer. The new technology allows users to unlock their devices by touching any display part. This solution could be particularly beneficial for foldable and rollable smartphones. The Galaxy Z Fold 7, anyone?

Samsung’s patent describes a full-screen fingerprint recognition sensor

Despite being a global leader in the foldable industry, Samsung has yet to implement under-display fingerprint scanners on its foldables. From the first-gen Galaxy Fold (2019) to the upcoming Galaxy Z Fold 6 and Flip 6, every model features a side-mounted capacitive sensor embedded into the power button. The company likely sees this as a more logical solution since a single sensor allows you to unlock the device in folded and unfolded states.

However, the size of the Fold sometimes makes it inconvenient to reach the power button when unfolded. Considering the device’s price, consumers deserve better. The Fold lineup should boast the best of everything the smartphone industry has to offer (it lags S series in cameras too, but that’s a different story). Some rival companies have already introduced under-display fingerprint scanners to their foldables, so that’s an added reason.

Samsung foldable rollable full screen fingerprint technology patent 4

It appears Samsung has a plan to one-up its rivals, at least in terms of fingerprint recognition on foldables. Noted leakster David Kowalski (aka xleaks7) recently collaborated with Thenerdstash to bring a Samsung patent for a full-screen fingerprint recognition technology for smartphones. It uses a layer of specialized sensors under the display. This layer is capable of reading fingerprints across the display and not just over a designated place on the screen.

While the patent documents describe its applications across a wide range of display products, this solution may be best suited for foldable and rollable smartphones. A confined fingerprint sensor doesn’t quite complement the big screens on these devices. It would be much better if we could unlock the device by placing our fingers anywhere on the screen. No need to carefully look for the fingerprint scanner’s location on the display.

Samsung foldable rollable full screen fingerprint technology patent 3

Could we see this technology on the Galaxy Z Fold 7?

Like with any other patent application, there is no way to tell if Samsung is actively working on this full-screen fingerprint recognition technology. It may be something the company has in the pipeline for the future. As far as its implementation on the Galaxy Z Fold 7 is concerned, we have doubts that will happen. The technology sounds too futuristic today. Rumors about the next-gen foldable should start coming in once the Galaxy Z Fold 6 and Flip 6 are out of the way. The sixth-gen models arrive on July 10.

Samsung foldable rollable full screen fingerprint technology patent 2


[ad_2]
Source link

Hacker Group Attacking Systems With 10 Malware At Same Time

0
[ad_1]

A malware campaign of huge magnitude, and perhaps run by just one group, is using artificially nested files for distribution named ‘WEXTRACT.EXE            .MUI’.

More than 50,000 files worldwide featuring this method are delivered by different stealers and loaders such as Redline, RisePro, and Amadey.

Several samples are associated with an Eastern European cybercriminal-linked Autonomous System.

Cybersecurity researchers at OutPost24 recently detected that a new hacker group has been attacking the system with 1o malware at the same time.

10 Malware At Same Time

The “WEXTRACT.EXE            .MUI” malware distribution system is one that makes use of nested cabinet files to distribute a number of malware samples such as stealers and loaders.

This method’s complex execution sequence drops and runs malware in reverse order, which may result in bypassing security measures.

"Is Your System Under Attack? Try Cynet XDR: Automated Detection & Response for Endpoints, Networks, & Users!"- Free Demo

The technique could cause multiple infections as the loaders may download more malware.

From February 2023 through the start of 2024, a massive malware distribution campaign nested multiple malware families, such as Redline, Mystic Stealer, RisePro, Amadey, and SmokeLoader.

The campaign developed over time, incorporating obfuscation tools and different distribution methods.

An examination of over two thousand one hundred examples showed some malware combinations in which victims might be infected by several stealers and loaders simultaneously.

This suggests that there was a single actor behind the infrastructure and tactics for this campaign.

Distribution steps of one sample of WEXTRACT (Source – OutPost24)

It is likely that the campaign to distribute malware called “Unfurling Hemlock” buys distribution services from other actors.

Its earliest phases were in email attachments and downloads from hacked or hoax websites.

The infrastructure, mostly based on AS 203727, uses both exclusive and shared IPs for distributing WEXTRACT and other malware.

This indicates one actor or entity that is responsible for the campaign but delegates some of its distribution aspects to others.

The malware campaign uses different C2 URLs and IP addresses, some of which are specific to the WEXTRACT-related malware and others that are common to other campaigns.

The diversity in infrastructure supports the insight that this actor could be supplying samples from other campaigns, possibly encouraged by financial interest.

While the upload locations may not indicate the actual infection sites, the infection sources cut across several countries.

Here below we have mentioned the countries:-

Origin of the samples (Source – OutPost24)

Unlike the usual trend, this huge malware attack mainly targets Western institutions, including Russia.

This operation launched different types of malware simultaneously to increase the possibilities of infection and diversify potential paybacks.

Though not highly developed, this “cluster bomb” method may be adopted by threat actors in the future.

Researchers recommended using the latest anti-malware tools, performing analysis of packed files, and user alertness to be cautious about suspicious downloads and emails.

Are you from SOC/DFIR Teams? - Sign up for a free ANY.RUN account! to Analyse Advanced Malware Files


[ad_2]
Source link

Here’s what the canceled Pixel Fold prototype looked like

0
[ad_1]

Google boarded the foldable smartphone bandwagon by launching the Pixel Fold at the I/O event 2023. By then, major brands like Samsung had already released multiple generations of their foldable smartphones. Although Google was late to the party, it already had a foldable phone in the pipeline since 2019.

The first-gen Google foldable smartphone was allegedly in active development under the codename “Passport” in 2020 and “Pipit” in 2022. Unfortunately, the first Google foldable prototype never saw the light of the day. However, nearly a year after the Pixel Fold’s launch, alleged photos of the canceled Google Pixel Fold prototype have appeared online.

The canceled Google Pixel Fold prototype had a familiar design

The photos of the alleged first-generation Google Pixel Fold prototype first appeared in an XDA forum thread last month. The original images have since been deleted. However, Android Authority managed to get copies of the images. Furthermore, the source claims that these images are indeed of the canceled Google Pixel Fold prototype. These photos are of the prototype, which was in development under the codename “Pipit” (Passport earlier).

The leaked images show that the first-generation Google Pixel Fold smartphone’s prototype had a familiar design. It appears to be eerily similar to the final Pixel Fold. The major difference between their design is a Pixel 6-like seamless glass bar running through the entire width of the prototype offering. The final product sports a smaller camera module made of polished metal, just like the Pixel 7 Pro.

Apart from the aforementioned differences, the Pipit prototype is almost similar to the final product. It has a similar aspect ratio, frame, and hinge design. Although it’s not visible in the images, the prototype model even had a matte back glass like the final phone. There appears to be a skin applied to the back of the prototype version.

Notably, the source claims that the Pipit foldable prototype even had support for a stylus. If launched, it would’ve arrived with the first-gen Tensor chipset, two 12MP primary Sony cameras, and an 8MP selfie snapper. Furthermore, the report suggests that the Pipit prototype had a smaller display at 66 x 128mm as compared to 67 x 130mm on the final Pixel Fold.

The Pixel Fold 2 is likely launching on August 13 alongside the Pixel 9 series

Google is now all set to host its annual “Made by Google” event on August 13. At the event, the company is expected to introduce a couple of new Pixel 9 series flagships. In addition, the Mountain View-based tech giant could also unveil the Pixel Fold 2 at the same event. Some reports suggest that the second-gen foldable offering from Google could be called the Pixel 9 Pro Fold instead.

Recently, a few leaked case render images suggested that the Pixel Fold 2 will be taller and narrower than the first-gen model when folded. The device will sport a much different primary camera island at the rear. It will be placed in the top-left corner of the handset’s backside as compared to the middle on the Pixel Fold.

The rumor mill indicates that the Pixel Fold 2 or Pixel 9 Pro Fold will be powered by the Tensor G4 chipset. It could be offered with up to 16GB of RAM and the upgraded UFS 4.0 faster storage solution. The new foldable is also expected to flaunt some AI-powered camera enhancements and more. We can expect official details about the phone in a matter of weeks, so stay tuned.


[ad_2]
Source link

Hackers Using Google Ads To Deliver ‘Poseidon’ Mac Stealer

0
[ad_1]

Hackers abuse Mac Stealer to covertly extract sensitive information such as passwords, financial data, and personal files from macOS devices.

Besides this, macOS users or Mac users are considered valuer targets.

On June 24th, Malwarebytes researchers identified another Mac-specific stealer campaign named Poseidon. This campaign used Google malicious ads for the Arc browser.

This is the second instance of Arc being used as a lure by OSX in recent times. RodStealer is distributing malware.

Created by Rodrigo4, a threat actor who competed with Atomic Stealer, this tool is more developed and can steal VPN configurations.

Hackers Using Google Ads

The ad for this malware was found on the XSS underground forum and it offers similar functionalities to Atomic Stealer such as file grabbing, extraction of crypto wallets, and theft of password managers.

"Is Your System Under Attack? Try Cynet XDR: Automated Detection & Response for Endpoints, Networks, & Users!"- Free Demo

What this campaign shows is that attackers responsible for Mac-related malware have started using new strategies while always exploiting popular software.

A Google ad campaign for the Arc browser that maliciously redirects people to a fraudulent site (arc-download[.]com) that offers a Mac-only version is connected to “Coles & Co” and arcthost[.]org.

Malicious ad for Arc browser via Google search (Source – Malwarebytes)

The downloaded DMG file uses a right-click bypass for security to make it seem like a genuine Mac application installation process.

This recent malware called “Poseidon,” which builds on previous ones, has incomplete code for stealing VPN configurations from Fortinet and OpenVPN.

Malware exfiltrates data to a specific IP address leading to a Poseidon-branded control panel, implying a sophisticated and evolving risk to MacOS users.

An active Mac malware development scene focuses on stealers like Poseidon. Threat actors advertise feature-rich products with low antivirus detection to potential customers. 

The observed campaign confirms the active targeting of new victims. Protection requires vigilance when installing new apps. 

Malwarebytes continues detecting this threat as OSX.RodStealer and has informed Google about the malicious ad. 

Users are advised to employ web protection tools like Malwarebytes Browser Guard to block ads and malicious websites as a primary defense against such evolving Mac-targeted threats.

IoCs

IoCs (Source – Malwarebytes)

Are you from SOC/DFIR Teams? - Sign up for a free ANY.RUN account! to Analyse Advanced Malware Files


[ad_2]
Source link