Reply to thread

Message

<blockquote data-quote="Trident" data-source="post: 1094407" data-attributes="member: 99014">This Nova Stealer is not a novel tactic. Malware in Electron packages has been discussed many times, there is even Check Point blog post.[URL unfurl=&quot;true&quot;]https://research.checkpoint.com/2022/new-malware-capable-of-controlling-social-media-accounts-infects-5000-machines-and-is-actively-being-distributed-via-gaming-applications-on-microsofts-official-store/[/URL][URL unfurl=&quot;true&quot;]https://blog.checkpoint.com/2023/02/01/the-rise-of-the-code-package-threat/amp/[/URL][URL unfurl=&quot;true&quot;]https://research.checkpoint.com/2022/28th-february-threat-intelligence-report/[/URL]One of the files “elevate.exe” packages inside doesn’t change, I’ve seen it in all Electron Bots/Nova variants. The malicious code inside is all based on JavaScript, running on the Node.js. It is controlled by sending commands through Telegram and Discord. The developers are very active, repackage frequently but don’t bother checking for behavioural detections (they just scan on VT to ensure there are no detections). After every new version, “customers” start complaining that detections are now happening.Alongside running security software, users are advised to download games only from trusted websites and stores, such as Steam.More about Nova Stealer can be learned here:[URL unfurl=&quot;true&quot;]https://www.cyfirma.com/research/emerging-maas-operator-sordeal-releases-nova-infostealer/[/URL][URL unfurl=&quot;true&quot;]https://www.broadcom.com/support/security-center/protection-bulletin/nova-stealer-among-the-malware-variants-distributed-via-facebook-ads-advertising-fake-ai-services[/URL]</blockquote>

[QUOTE="Trident, post: 1094407, member: 99014"] This Nova Stealer is not a novel tactic. Malware in Electron packages has been discussed many times, there is even Check Point blog post. [URL unfurl="true"]https://research.checkpoint.com/2022/new-malware-capable-of-controlling-social-media-accounts-infects-5000-machines-and-is-actively-being-distributed-via-gaming-applications-on-microsofts-official-store/[/URL] [URL unfurl="true"]https://blog.checkpoint.com/2023/02/01/the-rise-of-the-code-package-threat/amp/[/URL] [URL unfurl="true"]https://research.checkpoint.com/2022/28th-february-threat-intelligence-report/[/URL] One of the files “elevate.exe” packages inside doesn’t change, I’ve seen it in all Electron Bots/Nova variants. The malicious code inside is all based on JavaScript, running on the Node.js. It is controlled by sending commands through Telegram and Discord. The developers are very active, repackage frequently but don’t bother checking for behavioural detections (they just scan on VT to ensure there are no detections). After every new version, “customers” start complaining that detections are now happening. Alongside running security software, users are advised to download games only from trusted websites and stores, such as Steam. More about Nova Stealer can be learned here: [URL unfurl="true"]https://www.cyfirma.com/research/emerging-maas-operator-sordeal-releases-nova-infostealer/[/URL] [URL unfurl="true"]https://www.broadcom.com/support/security-center/protection-bulletin/nova-stealer-among-the-malware-variants-distributed-via-facebook-ads-advertising-fake-ai-services[/URL] [/QUOTE]

Verification