Weekly Cyber Round-up

Phishing campaign impersonates US Social Security Administration to deliver ConnectWise RAT

Cofense researchers observed a phishing campaign spoofing the United States Social Security Administration to deliver the ConnectWise remote access trojan (RAT). The campaign was first observed on September 16th, 2024, though the emails have since evolved to feature more deceptive email spoofing techniques, evasion tactics, and credential phishing attempts. The campaign reached peak volume on November 11th and 12th, 2024, a week after the day of the US presidential election. The emails contain embedded links that only redirect to the ConnectWise RAT payload once, while subsequent attempts to access the link redirect victims to a legitimate Social Security Administration website. After installing the RAT, victims are instructed to fill out a credential phishing form, allowing the threat actor to steal personal and financial information, bypass multi-factor authentication checks, and perform reconnaissance.

Fake CrowdStrike recruitment application leads to installation of XMRig

On January 7th, 2024, CrowdStrike researchers discovered a phishing campaign exploiting its recruitment branding to lure victims into downloading a fake employee CRM application, which serves as a downloader for the XMRig cryptocurrency miner. The phishing email claims to be part of the recruitment process and contains a link to a malicious website offering download options for both Windows and macOS. Regardless of the option selected by the victim, a Windows executable in Rust is downloaded, which functions as a downloader for XMRig. The executable displays a message claiming that there was an error during the installation process, which then leads to the download of a text file, used to download a ZIP file containing a copy of XMRig from GitHub.

Fake Mossad intelligence reports used to deliver XWorm to victims in the Middle East

Broadcom researchers detailed an ongoing campaign targeting users in the Middle East with supposed leaked Mossad intelligence reports. The documents aim to deliver the remote access trojan, XWorm, which is capable of achieving remote desktop access, keylogging, persistence, and data exfiltration. Stolen information is sent to a Telegram bot using a specific BotToken and ChatID. The infection chain starts with a RAR archive containing a JavaScript and a batch file, both disguised as legitimate documents. Upon execution, the files fetch a malicious JPG, which triggers PowerShell for further actions. Several legitimate processes are terminated to prevent detection, while registry entries for the current user are modified to maintain persistence. 

PhishWP WordPress plugin used to steal personal and financial details

SlashNext researchers warned of a malicious WordPress plugin that can turn legitimate sites into phishing pages. The plugin, dubbed PhishWP, creates fake payment pages that impersonate trusted services, such as Stripe. The fake pages are used to steal sensitive information such as credit card numbers, personal data, and browser metadata. The attack begins with attackers either breaking into a trusted WordPress site or creating a fake one. To increase the effectiveness of phishing campaigns, PhishWP uses customisable checkout pages, 3DS code harvesting, browser profiling, auto-response emails, multi-language support, and obfuscation techniques.