Cybersecurity experts have revealed the specifics of an ongoing multi-wave cyberattack targeting Adobe and Zoom software updates, business document reviews, and system maintenance utilities. This stealthy deployment method utilizes social engineering tactics to subtly install Remote Monitoring and Management (RMM) tools like ConnectWise ScreenConnect. A third sample linked to the activity is delivered as a compressed archive, which is then executed by a batch script to disable Windows Antimalware Scan Interface (AMSI), escalate privileges via UAC prompt, turn off SmartScreen protections through Registry modifications, and remove the Zone.Identifier alternate data stream (ADS) from the downloaded MSI file before running it.
Targeted applications include: - Web browsers: Brave Browser, Chrome, Edge, Opera, Opera GX, Vivaldi - Cryptocurrency wallets: Atomic, Cake Wallet, Exodus, Monero Wallet, SafePal, Tron Wallet - Software development tools: Git, JetBrains tools, Microsoft Visual Studio, Python IDLE - Game launchers: Battle.net, Epic Games Launcher, Riot Client, Rockstar Games Launcher, Steam - Virtual private networks (VPNs): ExpressVPN, Mullvad VPN, NordVPN, Surfshark - Messaging apps: Discord, Snapchat, Telegram, WhatsApp - Roblox and Minecraft installations: Feather, Lunar, Meteor, Modrinth, Prism, official Minecraft launcher To target Exodus cryptocurrency wallets, the malware checks for version 26.1.5 of Exodus on the system and unpacks the "app.asar" archive to inject JavaScript code that captures valid tokens and exfiltrates them to a C2 server.
