Même campagne de fausse mise à jour de navigateur, mais cette fois avec une nouvelle version de stealer pour macOS. Les chercheurs de Proofpoint ont identifié une nouvelle vague fin janvier 2025, utilisant les mêmes TTPs pour livrer les mêmes charges malveillantes.
🔍 Dans cette campagne, TA2727 ciblait spécifiquement les utilisateurs macOS hors Amérique du Nord. En visitant un site compromis, ils sont redirigés vers une fausse page de mise à jour Safari. En cliquant sur "Update", ils téléchargeaient et installaient un stealer, baptisé FrigidStealer par Proofpoint.
⬇️
"...a Mac user outside of North America visited the compromised website from a web browser, they were redirected to a fake update page that, if the Update button was clicked, downloaded and installed an information stealer. Proofpoint researchers named this malware FrigidStealer. "
👇
https://www.proofpoint.com/us/blog/threat-insight/update-fake-updates-two-new-actors-and-new-mac-malware
Here’s everything you need to know about the new info-stealing FakeUpdate malware campaign targeting Macs and how to avoid falling victim to a fake browser update attack along with other online safety tips and tricks.
#apple #macos #fakeupdate #malware
https://www.tomsguide.com/computing/online-security/macs-under-threat-from-new-info-stealing-malware-spread-through-fake-browser-updates-how-to-stay-safe
Es gibt schon sehr interessante Seiten im Internet.
Ich seid im Büro und braucht eine extra Pause? Kein Problem, ein Fake-Update hilft euch dabei 😂
Some more intel on the Eugenloader #FakeUpdate that @jeromesegura posted about a few weeks ago. Still seeing them using the same landing page for the FBU display, they've rotated through a few delivery domains now though.
FBU Display page:
doggygangers[.]com/YfMv2QsjpCQl845BWSYNfNOQitweyze_Z6lIlrRr43MRjX_HrM/land/universal_land/
Delivery Domains:
w6trw[.]com/wp-content/uploads/UpdateSetup-x86.msix
pipeline[.]pt/shop/upload/stowlcarousel/UpdateSetup-x86.msix
andaclesrealty[.]com/wp-content/uploads/2020/UpdateSetup-x86.msix
3sbrokers[.]com/wp-content/uploads/2024/04/UpdateSetup-x86.msix
Eugenloader C2:
utm-msh[.]com/profile
Most recent sample I pulled down:
9e800a05e65efe923a35815157129652980f03cbcf95cf0d64676f6da73471de
ClearFake, a threat leveraging compromised WordPress sites to push malicious fake browser updates, is likely operated by the group behind the SocGholish campaigns.
https://www.helpnetsecurity.com/2023/10/17/clearfake-malware-fake-browser-updates/
@rmceoin @monitorsg
#FakeUpdate #Malware #ClearFake #SocGholish #Cybersecurity
decio
TechHelpKB.com 📚
Tech Cybersecurity Nieuws
Tech Cybersecurity Nieuws
JackHusky
Jacob
Zeljka Zorz
Notor99