Rhadamanthys and Lumma, alongside other stealer malware families like Meduza, StealC, Vidar, and WhiteSnake, have also been found releasing updates in recent weeks to collect cookies from the Chrome web browser, effectively bypassing newly introduced security mechanisms like app-bound encryption. Furthermore, information stealers like Atomic, Rhadamanthys, and StealC have been at the heart of over 30 scam campaigns orchestrated by a cybercrime gang known as Marko Polo to conduct cryptocurrency theft across platforms by impersonating legitimate brands in online gaming, virtual meetings and productivity software, and cryptocurrency. "This allows Rhadamanthys to extract cryptocurrency wallet seed phrases from images, making it a highly potent threat for anyone dealing in cryptocurrencies," Recorded Future's Insikt Group said in an analysis of version 0.7.0 of the malware. This includes system information, credentials, cryptocurrency wallets, browser passwords, cookies, and data stored in various applications, while simultaneously taking steps to complicate analysis efforts within sandboxed environments. These ongoing updates also follow the discovery of new drive-by download campaigns that deliver information stealers by tricking users into manually copying and executing PowerShell code to prove they are human by means of a deceptive CAPTCHA verification page. Phishing and malvertising campaigns have also been observed distributing Atomic macOS Stealer (AMOS), Rilide, as well as a new variant of a stealer malware called Snake Keylogger (aka 404 Keylogger or KrakenKeylogger). As part of the campaign, users searching for video streaming services on Google are redirected to malicious URL that urges them to press the Windows button + R to launch the Run menu, paste an encoded PowerShell command, and execute it, according to CloudSEK, eSentire, Palo Alto Networks Unit 42, and Secureworks. First discovered in the wild in September 2022, Rhadamanthys has emerged as one of the most potent information stealers that are advertised under the malware-as-a-service (MaaS) model, alongside Lumma and others. The cybersecurity company, which is set to be acquired by Mastercard for $2.65 billion, said the stealer is sold on a subscription basis for $250 per month (or $550 for 90 days), allowing its customers to harvest a wide range of sensitive information from compromised hosts. On top of that, the developers behind the WhiteSnake Stealer have added the ability to extract CVC codes from credit cards stored in Chrome, highlighting the ever-evolving nature of the malware landscape. The attack, which ultimately delivers stealers such as Lumma, StealC, and Vidar, is a variant of the ClickFix campaign documented in recent months by ReliaQuest, Proofpoint, McAfee Labs, and Trellix. The malware continues to have an active presence despite suffering bans from underground forums like Exploit and XSS for targeting entities within Russia and the former Soviet Union, with its developer, who goes by the name "kingcrete" (aka "kingcrete2022"), finding ways to market the new versions on Telegram, Jabber, and TOX. Researchers have identified an Amadey malware campaign that deploys an AutoIt script, which then launches the victim's browser in kiosk mode to force them to enter their Google account credentials.
This Cyber News was published on thehackernews.com. Publication date: Tue, 01 Oct 2024 17:13:05 +0000