CP
cyberpings
Malware & RansomwareHIGH

Venom Stealer - New MaaS Fuels ClickFix and Crypto Theft

Featured image for Venom Stealer - New MaaS Fuels ClickFix and Crypto Theft
SCSC Media
Venom StealerClickFixcryptocurrency theftBlackFogmalware-as-a-service
🎯

Basically, Venom Stealer is a new malware that helps criminals steal money and passwords from your computer.

Quick Summary

A new malware-as-a-service, Venom Stealer, is facilitating ClickFix attacks that lead to cryptocurrency theft. Users of popular browsers are at risk. Organizations must implement strong security measures to defend against this evolving threat.

What Happened

A new malware-as-a-service (MaaS) called Venom Stealer has emerged, facilitating ClickFix attacks that result in cryptocurrency theft and credential compromise. Offered to vetted cybercriminals for as low as $250 per month, this service provides a web panel that enables users to conduct a variety of attacks. These range from social-engineering tactics to sophisticated methods for cracking cryptocurrency wallets.

The web panel includes four different ClickFix templates designed for both Windows and macOS users. These templates mimic legitimate processes, such as fake Cloudflare CAPTCHAs and operating system updates, tricking victims into executing harmful commands. The malware's payload is a C++ binary that targets popular browsers, extracting sensitive data like saved passwords and session cookies.

Who's Being Targeted

Venom Stealer primarily targets users of Chromium and Firefox browsers, making it a significant threat to anyone who stores sensitive information online. The malware is designed to exfiltrate data immediately, making detection challenging. This rapid exfiltration means that victims may not even realize their data has been compromised until it’s too late.

Organizations and individuals who frequently use cryptocurrency wallets are particularly at risk. Venom Stealer can bypass Chrome’s password encryption, allowing attackers to harvest credentials silently. As this MaaS continues to evolve, the potential for widespread damage increases.

Signs of Infection

Victims of Venom Stealer may notice unusual behavior on their devices, such as unexpected prompts or requests to run commands. However, due to the stealthy nature of this malware, many may not see immediate signs of infection. The malware operates by extracting data in the background, which can make it difficult for users to detect any anomalies.

To further complicate matters, the stolen wallet data is sent to a wallet-cracking engine that utilizes GPU infrastructure. This allows attackers to crack wallets from various platforms, including MetaMask and Trust Wallet, across multiple blockchains. The funds are then transferred to the attackers, making recovery nearly impossible for victims.

How to Protect Yourself

To defend against Venom Stealer and similar threats, organizations should implement strict security measures. This includes restricting PowerShell execution on Windows and using Group Policy to disable the Run dialog for standard users. Monitoring outbound traffic is crucial to catching data exfiltration events, as the malware’s rapid methods leave little room for detection.

Additionally, users should be educated about the risks associated with ClickFix attacks. Awareness of phishing tactics and the importance of verifying software updates can help mitigate the risk of infection. Regularly updating security software and conducting thorough scans can further protect against this evolving threat.

🔒 Pro insight: Venom Stealer's rapid data exfiltration methods highlight the need for enhanced outbound traffic monitoring to detect and respond to such threats effectively.

Original article from

SCSC Media
Read Full Article

Share

Related Pings

HIGHMalware & Ransomware

WhatsApp-Delivered VBS Malware Hijacks Windows via UAC Bypass

Microsoft warns of a new malware campaign using WhatsApp to distribute malicious VBS files. Windows users are at risk as attackers gain remote access and escalate privileges. Stay vigilant and avoid executing unknown scripts.

The Hacker News·
HIGHMalware & Ransomware

Infostealer Storm - New Malware Hijacks Sessions Seamlessly

A new infostealer named Storm is making waves in the cybercrime world. It stealthily hijacks sessions and decrypts sensitive data server-side. This poses serious risks to users, especially in corporate environments. Understanding its operation is key to enhancing security measures.

Varonis Blog·
HIGHMalware & Ransomware

Russian Hackers Exploit CTRL Toolkit for RDP Hijacking

Russian hackers are leveraging a new malware toolkit called CTRL to hijack RDP sessions and steal credentials. This poses a serious risk to organizations using remote access. Stay informed and protect your systems against this evolving threat.

Cyber Security News·
HIGHMalware & Ransomware

EtherRAT - Hackers Hide Malware Infrastructure on Ethereum

Hackers are leveraging EtherRAT to hide malware within the Ethereum blockchain. This sophisticated tool targets various sectors, making detection challenging. Organizations must act quickly to mitigate risks and protect their assets.

Cyber Security News·
HIGHMalware & Ransomware

CrystalX Malware - New MaaS Threat Spotted on Telegram

A new malware named CrystalX is being marketed on Telegram. This Malware-as-a-Service combines RAT and credential stealing features, posing significant risks to users worldwide. Organizations must act quickly to safeguard against this evolving threat.

Cyber Security News·
MEDIUMMalware & Ransomware

Malicious Script - Understanding Fileless Malware Persistence

A new malicious script reveals the rise of fileless malware. This stealthy malware minimizes its footprint while ensuring persistence through registry manipulation. Understanding this threat is crucial for effective cybersecurity.

SANS ISC·