Forest Global Training Partners

Cyber Risks · Cisco Talos

Magnat campaigns use malvertising to deliver information stealer, backdoor and malicious Chrome extension

Summary: Cisco Talos reports that Magnat campaigns use malvertising to deliver a fake software installer that drops three payloads: a password stealer, the MagnatBackdoor, and a malicious Chrome extension installed outside the Chrome Web Store and displayed as "Google's Safe browsing." The backdoor uses scheduled tasks to create a user, install RDPWrapper and plink.exe, and open an SSH tunnel forwarding RDP to an external server, while passive DNS shows roughly 50 percent of infections in Canada, followed by the U.S. and Australia.

What's compelling: The extension reads form data, logs keystrokes, and captures screenshots on matched URLs, so credentials entered in a browser can be taken even when they are never stored on the system. A backdoor that forwards RDP over an SSH tunnel to an external server gives attackers remote login that bypasses firewall control.

Read the original at Cisco Talos ↗

Topics
Malware
Related