Article Details
Scrape Timestamp (UTC): 2024-10-17 21:01:34.262
Original Article Text
Click to Toggle View
Fake Google Meet conference errors push infostealing malware. A new ClickFix campaign is luring users to fraudulent Google Meet conference pages showing fake connectivity errors that deliver info-stealing malware for Windows and macOS operating systems. ClickFix is a social-engineering tactic that emerged in May, first reported by cybersecurity company Proofpoint, from a threat actor (TA571) that used messages impersonating errors for Google Chrome, Microsoft Word, and OneDrive. The errors prompted the victim to copy to clipboard a piece of PowerShell code that would fix the issues by running it in Windows Command Prompt. Victims would thus infect systems with various malware such as DarkGate, Matanbuchus, NetSupport, Amadey Loader, XMRig, a clipboard hijacker, and Lumma Stealer. In July, McAfee reported that the ClickFix campaigns were becoming mode frequent, especially in the United States and Japan. A new report from Sekoia, a SaaS cybersecurity provider, notes that ClickFix campaigns have evolved significantly and now use a Google Meet lure, phishing emails targeting transport and logistics firms, fake Facebook pages, and deceptive GitHub issues. According to the French cybersecurity company, some of the more recent campaigns are conducted by two threat groups, the Slavic Nation Empire (SNE) and Scamquerteo, considered to be sub-teams of the cryptocurrency scam gangs Marko Polo and CryptoLove. The Google Meet trap The threat actors are using fake pages for Google Meet, the video communication service part of Google Workspace suite, popular in corporate environments for virtual meetings, webinars, and online collaboration. An attacker would send victims emails that appear like legitimate Google Meet invitations related to a work meeting/conference or some other important event. The URLs closely resemble actual Google Meet links: Once the victim gets on the fake page, they receive a pop-up message informing of a technical issue, such as a microphone or headset problem. If they click on "Try Fix," a standard ClickFix infection process starts where PowerShell code copied by the website and pasted on the Windows prompt infects their computer with malware, fetching the payload from the 'googiedrivers[.]com' domain. The final payloads are infostealing malware Stealc or Rhadamanthys on Windows. On a macOS machine, the threat actor drops the AMOS Stealer as a .DMG (Apple disk image) file named 'Launcher_v194.' Sekoia has identified several other malware distribution clusters in addition to Google Meet, including Zoom, PDF readers, fake video games (Lunacy, Calipso, Battleforge, Ragon), web3 browsers and projects (NGT Studio), and messenger apps (Nortex).
Daily Brief Summary
Cybersecurity firm Proofpoint first reported the social-engineering tactic known as ClickFix in May, involving faux connectivity errors prompting malware installation.
ClickFix campaigns, increasing in frequency particularly in the U.S. and Japan, now utilize Google Meet invitations to deliver info-stealing malware via deceptive links.
Victims encountering fake errors on these pages are tricked into copying and executing PowerShell code that deploys malware like DarkGate and Amadey Loader.
Recent Threat Intelligence from Sekoia indicates that these malware campaigns are associated with larger cybercriminal groups focused on cryptocurrency scams.
These malware payloads include Stealc and Rhadamanthys targeting Windows, and AMOS Stealer targeting macOS systems.
The threat actors have also expanded their attacks to include other platforms such as Zoom, PDF readers, and various online applications, creating a broad threat landscape.