The operators of the Purple Fox malware have retooled their malware arsenal with a new variant of a remote access trojan called FatalRAT, while also simultaneously upgrading their evasion mechanisms to bypass security software.
"Users' machines are targeted via trojanized software packages masquerading as legitimate application installers," Trend Micro researchers
said in a report published on March 25, 2022. "The installers are actively distributed online to trick users and increase the overall botnet infrastructure."
The findings follow
prior research from Minerva Labs that shed light on a similar modus operandi of leveraging fraudulent Telegram applications to distribute the backdoor. Other disguised software installers include WhatsApp, Adobe Flash Player, and Google Chrome.
These packages act as a first-stage loader, triggering an infection sequence that leads to the deployment of a second-stage payload from a remote server and culminating in the execution of a binary that inherits its features from FatalRAT.
thehackernews.com
