A brand new ClickFix marketing campaign is luring customers to fraudulent Google Meet convention pages exhibiting pretend connectivity errors that ship info-stealing malware for Home windows and macOS working techniques.
ClickFix is a social-engineering tactic that emerged in Could, first reported by cybersecurity firm Proofpoint, from a risk actor (TA571) that used messages impersonating errors for Google Chrome, Microsoft Phrase, and OneDrive.
The errors prompted the sufferer to repeat to clipboard a bit of PowerShell code that will repair the problems by working it in Home windows Command Immediate.
Victims would thus infect techniques with numerous malware similar to DarkGate, Matanbuchus, NetSupport, Amadey Loader, XMRig, a clipboard hijacker, and Lumma Stealer.
In July, McAfee reported that the ClickFix campaigns had been turning into mode frequent, particularly in the USA and Japan.
A brand new report from Sekoia, a SaaS cybersecurity supplier, notes that ClickFix campaigns have advanced considerably and now use a Google Meet lure, phishing emails focusing on transport and logistics companies, pretend Fb pages, and misleading GitHub points.
Supply: Sekoia
In response to the French cybersecurity firm, a few of the newer campaigns are performed by two risk teams, the Slavic Nation Empire (SNE) and Scamquerteo, thought of to be sub-teams of the cryptocurrency rip-off gangs Marko Polo and CryptoLove.
Supply: Sekoia
The Google Meet entice
The risk actors are utilizing pretend pages for Google Meet, the video communication service a part of Google Workspace suite, widespread in company environments for digital conferences, webinars, and on-line collaboration.
An attacker would ship victims emails that seem like authentic Google Meet invites associated to a piece assembly/convention or another vital occasion.
The URLs intently resemble precise Google Meet hyperlinks:
- meet[.]google[.]us-join[.]com
- meet[.]google[.]web-join[.]com
- meet[.]googie[.]com-join[.]us
- meet[.]google[.]cdm-join[.]us
As soon as the sufferer will get on the pretend web page, they obtain a pop-up message informing of a technical subject, similar to a microphone or headset downside.
Supply: Sekoia
In the event that they click on on “Strive Repair,” a regular ClickFix an infection course of begins the place PowerShell code copied by the web site and pasted on the Home windows immediate infects their pc with malware, fetching the payload from the ‘googiedrivers[.]com’ area.
The ultimate payloads are infostealing malware Stealc or Rhadamanthys on Home windows. On a macOS machine, the risk actor drops the AMOS Stealer as a .DMG (Apple disk picture) file named ‘Launcher_v194.’
Sekoia has recognized a number of different malware distribution clusters along with Google Meet, together with Zoom, PDF readers, pretend video video games (Lunacy, Calipso, Battleforge, Ragon), web3 browsers and tasks (NGT Studio), and messenger apps (Nortex).
