Dangerous BatLoader Malware Dropper

[upnorth]

Content source

https://www.darkreading.com/attacks-breaches/researchers-alarm-batloader-malware-dropper

Researchers at VMware Carbon Black are tracking the threat, dubbed BatLoader, and say its operators are using the dropper to distribute a variety of malware tools including a banking Trojan, an information stealer, and the Cobalt Strike post-exploit toolkit on victim systems. The threat actor's tactic has been to host the malware on compromised websites and lure users to those sites using search engine optimization (SEO) poisoning methods.

BatLoader relies heavily on batch and PowerShell scripts to gain an initial foothold on a victim machine and to download other malware onto it. This has made the campaign hard to detect and block, especially in the early stages, analysts from VMware Carbon Black's managed detection and response (MDR) team said in a report released on Nov. 14.

VMware said its Carbon Black MDR team had observed 43 successful infections in the last 90 days, in addition to numerous other unsuccessful attempts where a victim downloaded the initial infection file but did not execute it. Nine of the victims were organizations in the business services sector, seven were financial services companies, and five were in manufacturing. Other victims included organizations in the education, retail, IT, and healthcare sectors.

On Nov. 9, eSentire said its threat-hunting team had observed BatLoader's operator luring victims to websites masquerading as download pages for popular business software such as LogMeIn, Zoom, TeamViewer, and AnyDesk. The threat actor distributed links to these websites via ads that showed up prominently in search engine results when users searched for any of these software products.

Researchers Sound Alarm on Dangerous BatLoader Malware Dropper

 

[silversurfer]

The malware downloader known as BATLOADER has been observed abusing Google Ads to deliver secondary payloads like Vidar Stealer and Ursnif.

According to cybersecurity company eSentire, the malicious ads are used to spoof a wide range of legitimate apps and services such as Adobe, OpenAPI's ChatGPT, Spotify, Tableau, and Zoom.

BATLOADER Malware Uses Google Ads to Deliver Vidar Stealer and Ursnif Payloads

Malware downloader BATLOADER has been found abusing Google Ads to deliver secondary payloads like Vidar Stealer and Ursnif.

thehackernews.com

BatLoader Continues to Abuse Google Search Ads to Deliver Vidar…

Learn more about the BatLoader malware, how we detected the attack, and recommendations from our Threat Response Unit (TRU) to protect your business from this cyber threat.

www.esentire.com

 

[silversurfer]

Malicious Google Search ads for generative AI services like OpenAI ChatGPT and Midjourney are being used to direct users to sketchy websites as part of a BATLOADER campaign designed to deliver RedLine Stealer malware.

"Both AI services are extremely popular but lack first-party standalone apps (i.e., users interface with ChatGPT via their web interface while Midjourney uses Discord)," eSentire said in an analysis."This vacuum has been exploited by threat actors looking to drive AI app-seekers to imposter web pages promoting fake apps."

Searching for AI Tools? Watch Out for Rogue Sites Distributing RedLine Malware

Hackers are using Google Search ads to trick AI tool seekers into downloading malware.

thehackernews.com

FakeBat Impersonates Midjourney, ChatGPT in Drive-by Cyberattacks

Learn more about how threat actors are exploiting ChatGPT and Midjourney to deliver the FakeBat malware using Google Search Ads and get security…

www.esentire.com

 

[oldschool]

Searching for AI Tools? Watch Out for Rogue Sites Distributing RedLine Malware

Hackers are using Google Search ads to trick AI tool seekers into downloading malware.

thehackernews.com

FakeBat Impersonates Midjourney, ChatGPT in Drive-by Cyberattacks

Learn more about how threat actors are exploiting ChatGPT and Midjourney to deliver the FakeBat malware using Google Search Ads and get security…

www.esentire.com

This is definitely choice:

Once the installation is complete, the binary makes use of Microsoft Edge WebView2 to load chat.openai[.]com or www.midjourney[.]com – the legitimate ChatGPT and Midjourney URLs – in a pop-up window so as to not raise any red flags.

At least Edge is good at something.