New LOBSHOT malware gives hackers hidden VNC access to Windows devices


Level 44
Thread author
Top Poster
Nov 10, 2017
A new malware known as ‘LOBSHOT’ distributed using Google ads allows threat actors to stealthily take over infected Windows devices using hVNC.

Earlier this year, BleepingComputer and numerous cybersecurity researchers reported a dramatic increase in threat actors utilizing Google ads to distribute malware in search results.

These advertising campaigns impersonated websites for 7-ZIP, VLC, OBS, Notepad++, CCleaner, TradingView, Rufus, and many more applications.

However, these sites pushed malware instead of distributing legitimate applications, including Gozi, RedLine, Vidar, Cobalt Strike, SectoRAT, and the Royal Ransomware.

Full article

Andy Ful

From Hard_Configurator Tools
Honorary Member
Top Poster
Dec 23, 2014
Once executed, the malware will check if Microsoft Defender is running, and if detected, terminate execution to prevent detection.

However, if Defender is not detected, the malware will configure Registry entries to start automatically when logging in to Windows and then transmit system information from the infected device, including running processes.

The infection chain:
Google Ads ----> weaponized MSI installer ----> PowerShell -----> run DLL malware
is pretty common nowadays. This attack vector avoids using EXE files which are better detected by AVs.
Last edited:

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.