Malware Alert: BitRAT and Lumma Stealer Disguised in Fake Browser Updates
Discover how threat actors are leveraging fake browser updates to deploy BitRAT and Lumma Stealer malware, as eSentire’s Threat Response Unit (TRU) uncovers the intricacies of the infection chain and provides actionable insights to mitigate the risks posed by these sophisticated threats.
- Fake browser updates are being exploited as a delivery mechanism for BitRAT and Lumma Stealer malware, which eSentire’s Threat Response Unit (TRU) detected in May 2024.
- The malware payloads, hidden within JavaScript code and disguised as .png files, are deployed through PowerShell scripts, highlighting the need for heightened user awareness and robust endpoint protection measures.
Fake browser updates have emerged as a prevalent method for delivering malware, as highlighted in a recent finding by eSentire’s Threat Response Unit (TRU). In May 2024, TRU uncovered instances of fake updates distributing BitRAT and Lumma Stealer, both notorious for their data-stealing capabilities.
The attack typically initiates when a user visits a compromised webpage containing malicious JavaScript code. This code redirects users to a fraudulent update page, urging them to download a Zip archive named ‘Update.zip’ from Discord’s Content Distribution Network (CDN). Within this archive lies a JavaScript file (Update.js) that is the initial downloader, fetching the payloads upon execution.
See more: EU Watchdog Enforces Accountability for AI Use in Banking
Upon executing Update.js, multiple PowerShell scripts are activated, hosted on a known BitRAT Command-and-Control (C2) address. These scripts facilitate the download and execution of subsequent payloads, masquerading as .png files with various functions, including loading, persistence, and actual payload delivery.
One such payload, BitRAT, boasts many features like remote desktop access and cryptocurrency mining. Lumma Stealer, the other detected payload, specializes in pilfering sensitive data such as cryptocurrency wallets and browser extensions, operating as a Malware-as-a-Service.
The utilization of fake updates as a delivery conduit underscores the necessity for user vigilance regarding the legitimacy of update prompts. Implementing robust endpoint protection tools and conducting security awareness training programs can mitigate such threats effectively.
MORE ON TECH
