In the ever-evolving landscape of cybersecurity threats, a new menace has surfaced: the Hijack Loader malware. This malicious software is being spread through free or pirated versions of popular commercial software, tricking unsuspecting users into compromising their systems.
The Hijack Loader Threat
Trellix security researcher Ale Houspanossian recently highlighted how threat actors are distributing Hijack Loader by embedding it within password-protected archive files. One notable example involves a trojanized version of the Cisco Webex Meetings App (ptService.exe).
When users download these seemingly legitimate files, they unwittingly extract a malicious “Setup.exe” file. This file, disguised as the Cisco Webex Meetings application, stealthily loads the Hijack Loader, which then executes an information-stealing module known as Vidar Stealer.
How It Works
The initial infection vector is a RAR archive file that contains an executable named “Setup.exe.” This executable is actually a copy of Cisco Webex Meetings’ ptService module. The malware employs DLL side-loading techniques to launch Hijack Loader (also known as DOILoader or IDAT Loader). This loader acts as a conduit to deploy Vidar Stealer via an AutoIt script.
The attack chain further employs techniques to bypass User Account Control (UAC) and exploit the CMSTPLUA COM interface for privilege escalation. Once escalated, the malware adds itself to Windows Defender’s exclusion list to evade detection. Besides stealing sensitive credentials from web browsers, Vidar Stealer can also deploy a cryptocurrency miner on the compromised host.
Recent Trends and Campaigns
This disclosure follows a rise in ClearFake campaigns, where site visitors are tricked into manually executing a PowerShell script to resolve a fictitious issue with web page viewing. This script then serves as a launchpad for Hijack Loader, which ultimately delivers Lumma Stealer malware. Lumma Stealer is capable of downloading additional payloads, including Amadey Loader, XMRig miner, and a clipper malware to redirect cryptocurrency transactions.
Proofpoint researchers recently observed another campaign named ClickFix, which used faulty browser update lures on compromised sites to propagate Vidar Stealer. This campaign used a similar mechanism, involving PowerShell code execution, to deliver the malware.
TA571, another threat actor, has also adopted similar social engineering tactics in its malspam campaigns. Emails containing HTML attachments display an error message about a missing “Word Online” extension. Victims who attempt to fix this issue are tricked into executing malicious PowerShell commands, leading to the deployment of Matanbuchus or DarkGate malware.
The Challenge of Detection
These campaigns highlight the challenges in detecting and blocking such threats. The legitimate appearance and the variety of methods to store and execute malicious code make it difficult for antivirus software and Endpoint Detection and Response (EDR) tools to detect them. Detection needs to occur before the malicious HTML or site is presented to the victim.
Conclusion
As cybersecurity threats continue to evolve, it’s crucial to remain vigilant and cautious about the software you download and execute. Always verify the source of your downloads and be wary of free or pirated software. Following safe browsing practices and keeping your security software up to date can help protect against these sophisticated threats.
Found this article interesting? Follow us on Facebook and LinkedIn to read more exclusive content from CybrogenIT.
By staying informed and cautious, you can better protect yourself and your business from these emerging threats.