The Russia-linked risk actor referred to as COLDRIVER has been noticed distributing a brand new malware referred to as LOSTKEYS as a part of an espionage-focused marketing campaign utilizing ClickFix-like social engineering lures.
“LOSTKEYS is able to stealing information from a hard-coded listing of extensions and directories, together with sending system info and working processes to the attacker,” the Google Menace Intelligence Group (GTIG) said.
The malware, the corporate mentioned, was noticed in January, March, and April 2025 in assaults on present and former advisors to Western governments and militaries, in addition to journalists, suppose tanks, and NGOs. As well as, people related to Ukraine have additionally been singled out.
LOSTKEYS is the second customized malware attributed to COLDRIVER after SPICA, marking a continued departure from the credential phishing campaigns the risk actor has been identified for. The hacking group can also be tracked underneath the names Callisto, Star Blizzard, and UNC4057.
“They’re identified for stealing credentials and after having access to a goal’s account they exfiltrate emails and steal contact lists from the compromised account,” safety researcher Wesley Shields mentioned. “In choose circumstances, COLDRIVER additionally delivers malware to focus on units and should try and entry information on the system.”
The newest set of assaults commences with a decoy web site containing a faux CAPTCHA verification immediate, the place victims are instructed to open the Home windows Run dialog and paste a PowerShell command copied to the clipboard, a broadly fashionable social engineering approach dubbed ClickFix.
The PowerShell command is designed to obtain and execute the subsequent payload from a distant server (“165.227.148[.]68”), which acts as a downloader for a third-stage however not earlier than performing checks in a possible effort to evade execution in digital machines.
A Base64-encoded blob, the third-stage payload is decoded right into a PowerShell script that is answerable for executing LOSTKEYS on the compromised host, permitting the risk actor to reap system info, working processes, and information from a hard-coded listing of extensions and directories.
Like within the case of SPICA, it has been assessed that the malware is simply deployed selectively, indicative of the highly-targeted nature of those assaults.
Google additionally mentioned it uncovered extra LOSTKEYS artifacts going again to December 2023 that masqueraded as binaries associated to the Maltego open-source investigation platform. It isn’t identified if these samples have any ties to COLDRIVER, or if the malware was repurposed by the risk actors beginning January 2025.
ClickFix Adoption Continues to Develop
The event comes as ClickFix continues to be steadily adopted by a number of risk actors to distribute a variety of malware households, together with a banking trojan referred to as Lampion and Atomic Stealer.
Assaults propagating Lampion, per Palo Alto Networks Unit 42, use phishing emails bearing ZIP file attachments as lures. Current throughout the ZIP archive is an HTML file that redirects the message recipient to a faux touchdown web page with ClickFix directions to launch the multi-stage an infection course of.
“One other fascinating facet of Lampion’s an infection chain is that it’s divided into a number of non-consecutive phases, executed as separate processes,” Unit 42 said. “This dispersed execution complicates detection, because the assault stream doesn’t kind a readily identifiable course of tree. As a substitute, it contains a posh chain of particular person occasions, a few of which may seem benign in isolation.”
The malicious marketing campaign focused Portuguese-speaking people and organizations in numerous sectors, together with authorities, finance, and transportation, the corporate added.
In current months, the ClickFix technique has additionally been mixed with one other sneaky tactic referred to as EtherHiding, which entails utilizing Binance’s Good Chain (BSC) contracts to hide the next-stage payload, finally resulting in the supply of a macOS info stealer referred to as Atomic Stealer.
“Clicking ‘I am not a robotic’ triggers a Binance Good Contract, utilizing an EtherHiding approach, to ship a Base64-encoded command to the clipboard, which customers are prompted to run in Terminal by way of macOS-specific shortcuts (⌘ + House, ⌘ + V),” an impartial researcher who goes by the alias Badbyte said. “This command downloads a script that retrieves and executes a signed Mach-O binary, confirmed as Atomic Stealer.”
Additional investigation has discovered that the marketing campaign has possible compromised about 2,800 respectable web sites to serve faux CAPTCHA prompts. The big-scale watering gap assault has been codenamed MacReaper by the researcher.
“The assault leverages obfuscated JavaScript, three full-screen iframes, and blockchain-based command infrastructure to maximise infections,” the researcher added.
Source link