Hackers are concentrating on different hackers with a faux OnlyFans device that claims to assist steal accounts however as an alternative infects risk actors with the Lumma stealer information-stealing malware.
The operation, found by Veriti Analysis, constitutes a attribute instance of the blurred traces between being a predator or prey on this planet of cybercrime, the place ironic twists and backstabs are ample.
“Checking” right into a Lumma an infection
OnlyFans is an especially fashionable subscription-based grownup content material platform the place creators can earn cash from customers (known as “followers”) who pay for entry to their content material.
Creators can share movies, pictures, messages, and stay streams with their subscribers, whereas subscribers pay a recurring price or one-time funds for unique content material.
Given its reputation, OnlyFans accounts typically turn into targets of risk actors who try and hijack them to steal fan funds, extort the account proprietor to pay a ransom, or just leak personal photographs.
Checker instruments are designed to assist validate giant units of stolen login credentials (usernames and passwords), checking if the login particulars match any OnlyFans accounts and whether or not they’re nonetheless legitimate.
With out these instruments, cybercriminals must manually take a look at out 1000’s of credential pairs, an impractical and tedious course of that will render the scheme nonviable.
Nevertheless, these instruments are generally created by different cybercriminals, inflicting hackers to belief that they’re protected to make use of, and in some instances, this backfires.
Veriti found a case of an OnlyFans checker promising to confirm credentials, test account balances, confirm cost strategies, and decide creator privileges however as an alternative put in the Lumma information-stealing malware.
Supply: Veriti
The payload, named “brtjgjsefd.exe,” is fetched from a GitHub repository and loaded into the sufferer’s pc.
Lumma is an information-stealing malware-as-a-service (MaaS) that has been rented to cybercriminals since 2022 for $250-$1000/month and distributed through numerous means, together with malvertising, YouTube feedback, torrents, and, extra lately, GitHub feedback.
It’s a complicated data stealer with modern evasion mechanisms and the power to restore expired Google session tokens. It’s principally recognized for stealing two-factor authentication codes, cryptocurrency wallets, and passwords, cookies, and bank cards saved on a sufferer’s browser and file system.
Lumma additionally doubles as a loader itself, able to introducing further payloads onto the compromised system and executing PowerShell scripts.
A broader deception operation
Veriti discovered that when the Lumma Stealer payload is launched, it can connect with a GitHub account below the title “UserBesty,” which the cybercriminal behind this marketing campaign makes use of to host different malicious payloads.
Supply: Veriti
Particularly, the GitHub repository incorporates executables that resemble checkers for Disney+ accounts, Instagram, and a supposed Mirai botnet builder:
- Disney+ account thieves are focused with “DisneyChecker.exe”
- Instagram hackers are lured by “InstaCheck.exe”
- Wannabe botnet creators are lured with “ccMirai.exe”
Digging deeper into the malware’s communications, Veriti’s researchers discovered a set of “.store” domains that acted as command and management (C2) servers, sending instructions to Lumma and receiving the exfiltrated knowledge.
This marketing campaign will not be the primary time risk actors have focused different cybercriminals in malicious assaults.
In March 2022, hackers focused hackers with clipboard stealers disguised as cracked RATs and malware-building instruments to steal cryptocurrency.
Later that yr, a malware developer backdoored their very own malware to steal credentials, cryptocurrency wallets, and VPN account knowledge from different hackers.