TechCapsules

AI-summarised brief · reviewed before publication

Cybersecurity researchers have recently uncovered a malicious campaign that utilizes search engine optimization (SEO) poisoning techniques to distribute a known malware loader called Oyster, also referred to as Broomstick or CleanUpLoader. The malvertising activity, as observed by Arctic Wolf, promotes fake websites that host trojanized versions of legitimate tools such as PuTTY and WinSCP. These fake websites are designed to trick software professionals who are searching for these programs into installing the malware instead. When executed, a backdoor known as Oyster/Broomstick is installed on the victim's device. The malware then establishes persistence by creating a scheduled task that runs every three minutes, executing a malicious DLL (twain_96.dll) via rundll32.exe using the DllRegisterServer export. This indicates the use of DLL registration as part of the persistence mechanism. Some of the bogus websites suspected to be involved in this campaign have been identified. It is believed that the threat actors behind this campaign may also be targeting other IT tools to deliver the malware, making it essential for users to stick to trusted sources and official vendor sites to download the necessary software. Notably, this disclosure comes as black hat SEO poisoning techniques are being used to manipulate search results associated with artificial intelligence (AI)-related keywords to spread malware such as Vidar, Lumma, and Legion Loader. These malicious websites come equipped with JavaScript code that checks for the presence of ad blockers and gathers information from the victim's browser before initiating a redirection chain that ultimately takes the victim to a phishing page hosting a ZIP archive. The final download pages in this campaign deliver Vidar Stealer and Lumma Stealer as password-protected ZIP archives, with the password provided on the final downloading page. Once extracted, they contain an 800MB NSIS installer, which is deceptively large in size, intended to appear legitimate and bypass detection systems with file size limitations. The NSIS installer is then used to execute a malicious payload on the victim's device.