A brand new ClickFix marketing campaign is luring customers to fraudulent Google Meet convention pages exhibiting faux connectivity errors that ship info-stealing malware for Home windows and macOS working techniques.
ClickFix is a social-engineering tactic that emerged in Could, first reported by cybersecurity firm Proofpoint, from a risk actor (TA571) that used messages impersonating errors for Google Chrome, Microsoft Phrase, and OneDrive.
The errors prompted the sufferer to repeat to clipboard a chunk of PowerShell code that may repair the problems by working it in Home windows Command Immediate.
Victims would thus infect techniques with varied malware reminiscent of DarkGate, Matanbuchus, NetSupport, Amadey Loader, XMRig, a clipboard hijacker, and Lumma Stealer.
In July, McAfee reported that the ClickFix campaigns have been changing into mode frequent, particularly in the US and Japan.
A brand new report from Sekoia, a SaaS cybersecurity supplier, notes that ClickFix campaigns have advanced considerably and now use a Google Meet lure, phishing emails concentrating on transport and logistics corporations, faux Fb pages, and misleading GitHub points.
Supply: Sekoia
In response to the French cybersecurity firm, a few of the more moderen campaigns are carried out by two risk teams, the Slavic Nation Empire (SNE) and Scamquerteo, thought of to be sub-teams of the cryptocurrency rip-off gangs Marko Polo and CryptoLove.
Supply: Sekoia
The Google Meet lure
The risk actors are utilizing faux pages for Google Meet, the video communication service a part of Google Workspace suite, in style in company environments for digital conferences, webinars, and on-line collaboration.
An attacker would ship victims emails that appear as if official Google Meet invites associated to a piece assembly/convention or another vital occasion.
The URLs carefully resemble precise Google Meet hyperlinks:
- meet[.]google[.]us-join[.]com
- meet[.]google[.]web-join[.]com
- meet[.]googie[.]com-join[.]us
- meet[.]google[.]cdm-join[.]us
As soon as the sufferer will get on the faux web page, they obtain a pop-up message informing of a technical problem, reminiscent of a microphone or headset downside.
Supply: Sekoia
In the event that they click on on “Strive Repair,” a normal ClickFix an infection course of begins the place PowerShell code copied by the web site and pasted on the Home windows immediate infects their laptop with malware, fetching the payload from the ‘googiedrivers[.]com’ area.
The ultimate payloads are infostealing malware Stealc or Rhadamanthys on Home windows. On a macOS machine, the risk actor drops the AMOS Stealer as a .DMG (Apple disk picture) file named ‘Launcher_v194.’
Sekoia has recognized a number of different malware distribution clusters along with Google Meet, together with Zoom, PDF readers, faux video video games (Lunacy, Calipso, Battleforge, Ragon), web3 browsers and initiatives (NGT Studio), and messenger apps (Nortex).