credential theft Archives

Tech Optimizer

May 31, 2025

Authorities Dismantled AVCheck, a Tool For Testing Malware Against Antivirus Detection

Law enforcement agencies from multiple nations dismantled a cybercriminal operation that provided malware testing services to evade antivirus detection. This effort led to the seizure of four domains and their servers, disrupting infrastructure that facilitated ransomware attacks globally. U.S. Attorney Nicholas J. Ganjei announced the disruption of an online software crypting syndicate that helped cybercriminals keep their malware undetected. The seized domains offered counter-antivirus tools and crypting services, allowing criminals to obfuscate malware and gain unauthorized access to systems. Investigators conducted undercover purchases and analyzed services, revealing connections to ransomware groups targeting victims in the U.S. and internationally. The operation, part of Operation Endgame, involved collaboration among the U.S., Netherlands, France, Germany, Denmark, Ukraine, and Portugal, with the FBI Houston Field Office leading the U.S. investigation. The seizures occurred on May 27.

Tech Optimizer

May 29, 2025

A Trojan-Downloading Website Is Imitating a Popular Antivirus Website

Hackers are increasingly using sophisticated techniques to entice users into downloading malware, with many individuals still falling victim to basic social engineering tactics. A counterfeit website mimicking the legitimate antivirus program Bitdefender has been created, which could mislead users. This spoofed site hosts a bundled executable named StoreInstaller.exe that contains malware configurations linked to VenomRAT, capable of remote access, credential theft, keylogging, and data exfiltration. The counterfeit site closely resembles the legitimate one, making it difficult for untrained users to distinguish between them. Users are advised to download antivirus software only from reputable sources and to verify the authenticity of the website before proceeding.

Winsage

May 25, 2025

Windows Passwords Are Under Attack — Do These 7 Things Now

Microsoft Windows is a target for cybercriminals, particularly regarding password theft. Trend Micro has reported an increase in fraudulent Captcha attacks that trick users into executing malicious commands through the Windows Run dialog, leading to data theft and malware infections. These attacks utilize PowerShell and can deploy various malware types, including Lumma Stealer and AsyncRAT. Despite efforts to disrupt the Lumma Stealer network, threats persist, exploiting legitimate platforms. Microsoft recommends users adopt safer online practices and outlines seven mitigations for organizations: disable access to the Run dialog, apply least privilege, restrict access to unapproved tools, monitor unusual behavior, harden browser configurations, enable memory protection, and invest in user education.

Tech Optimizer

May 23, 2025

Cloudflare, Microsoft & police disrupt global malware service

Cloudflare, in collaboration with Microsoft and international law enforcement, has dismantled the infrastructure of LummaC2, an information-stealing malware service. This initiative led to the seizure and blocking of malicious domains and disrupted digital marketplaces used by criminals. Lumma Stealer operates as a subscription service providing threat actors access to a central panel for customized malware builds and stolen data retrieval. The stolen information includes credentials, cryptocurrency wallets, and sensitive data, posing risks of identity theft and financial fraud. Lumma Stealer was first identified on Russian-language crime forums in early 2023 and has since migrated to Telegram for distribution. Its proliferation is facilitated by social engineering campaigns, including deceptive pop-ups and bundled malware in cracked software. Cloudflare implemented measures to block access to Lumma's command and control servers and collaborated with various authorities to prevent the criminals from regaining control. Mitigation strategies for users include restricting unknown scripts, limiting password storage in browsers, and using reputable endpoint protection tools. The operation has significantly hindered Lumma's operations and aims to undermine the infostealer-as-a-service model contributing to cybercrime.

Tech Optimizer

May 21, 2025

Lumma Stealer: Breaking down the delivery techniques and capabilities of a prolific infostealer

Microsoft has monitored Lumma Stealer, an infostealer malware used by financially motivated threat actors. Lumma Stealer, also known as LummaC2, functions as a malware-as-a-service (MaaS) solution that extracts data from browsers and applications, including cryptocurrency wallets. The entity behind Lumma is identified as Storm-2477, which maintains the malware and its command-and-control (C2) infrastructure. Affiliates can create malware binaries and manage C2 communications through a panel provided by Storm-2477. Ransomware groups have integrated Lumma Stealer into their operations. Lumma Stealer employs various delivery techniques, including phishing emails, malvertising, drive-by downloads, Trojanized applications, and abuse of legitimate services. Specific campaigns have been identified, such as one in April 2025 that used EtherHiding and ClickFix techniques to deliver Lumma Stealer via compromised websites. Another campaign on April 7, 2025, targeted Canadian organizations with emails containing invoice lures that led to malicious downloads. The malware is developed using C++ and ASM, employing advanced obfuscation techniques to evade detection. It can extract a wide range of user data, including browser credentials, cryptocurrency wallet information, and user documents. Lumma Stealer maintains a robust C2 infrastructure with multiple hardcoded and fallback C2 servers, utilizing encryption methods to secure communications. Microsoft's Digital Crimes Unit has disrupted Lumma Stealer's infrastructure by blocking approximately 2,300 malicious domains. Recommendations to mitigate the impact of Lumma Stealer include strengthening Microsoft Defender configurations, implementing multifactor authentication, and utilizing phishing-resistant authentication methods. Microsoft Defender products can detect and block activities associated with Lumma Stealer, providing alerts and insights for incident response.

AppWizard

May 14, 2025

Marbled Dust leverages zero-day in Output Messenger for regional espionage

Since April 2024, the threat actor Marbled Dust has been exploiting a zero-day vulnerability (CVE-2025-27920) in the Output Messenger chat application, targeting user accounts that have not applied necessary fixes. This exploitation has resulted in the collection of sensitive data from users in Iraq, specifically linked to the Kurdish military. Microsoft has high confidence in this assessment and notes that Marbled Dust conducts reconnaissance to identify potential targets using Output Messenger. Marbled Dust has successfully utilized this vulnerability to deploy malicious files and exfiltrate data. Microsoft notified the application’s developer, Srimax, about the vulnerability, leading to the release of a software update. A second vulnerability (CVE-2025-27921) was also found, but no exploitation of this second flaw has been observed. The zero-day vulnerability allows an authenticated user to upload malicious files to the server's startup directory. Marbled Dust has exploited this flaw to place a backdoor file, OMServerService.vbs, in the startup folder, enabling them to access communications and sensitive data indiscriminately. The attack chain begins with Marbled Dust gaining access to the Output Messenger Server Manager, likely through DNS hijacking or other credential interception techniques. Once inside, they exploit the vulnerability to drop malicious files, including a GoLang backdoor, which connects to a Marbled Dust command-and-control domain for data exfiltration. To mitigate this threat, Microsoft recommends updating to the latest version of Output Messenger, activating various security protections, and implementing rigorous vulnerability management strategies. Microsoft Defender XDR customers can identify potential threat activity through specific alerts related to Marbled Dust and utilize advanced hunting queries for detection. Indicators of compromise include traffic to the domain api.wordinfos[.]com, associated with Marbled Dust activities.

Winsage

May 6, 2025

Expanding the Surface for Business Copilot+ PC portfolio

AI has evolved into a transformative force for organizations, increasing the demand for secure and high-performance AI-ready Windows 11 PCs. Microsoft has introduced Copilot+ PCs, including the new 12-inch Surface Pro and 13-inch Surface Laptop, both powered by the Snapdragon X Plus processor with an integrated neural processing unit (NPU) capable of 45 trillion operations per second. The 13-inch Surface Laptop offers up to 23 hours of video playback and 16 hours of web browsing, with performance enhancements of up to 50% faster speeds and double the battery life compared to its predecessor. It features an AI-enhanced 1080p front camera for video conferencing and a durable design. The 12-inch Surface Pro is the thinnest and lightest Copilot+ PC, providing 50% faster performance and up to 16 hours of local video playback. Both devices are designed as Secured-core PCs with advanced security features, including Windows Hello for Business and biometric authentication options. They support enhanced productivity through AI features in Windows 11 and Microsoft 365 Copilot, enabling faster file searches and improved team efficiency. Microsoft emphasizes sustainability with the use of recycled materials and energy-efficient designs. The new devices will be available starting July 22 in select markets.

Tech Optimizer

April 30, 2025

5 Free Antivirus Programs To Eliminate Malware and Viruses (2025)

Users are increasingly seeking effective malware protection without the cost of premium software, leading to the emergence of free antivirus programs that offer robust security features. This trend is particularly beneficial for Windows 11 users who want real-time protection while staying within budget. Several leading cybersecurity firms provide free antivirus solutions equipped with advanced features such as real-time scanning, phishing defenses, cloud-based malware detection, and system optimization tools. These free programs can adequately protect a diverse audience, including gamers, remote workers, students, and casual users. Top free antivirus programs for Windows 11 in 2025 include: 1. Bitdefender Antivirus Free: Utilizes the same malware engine as its paid version, offers real-time detection, anti-phishing protection, and is ultra-light on system resources. 2. Microsoft Defender Antivirus: Integrated into Windows 11, provides cloud-delivered protection and built-in ransomware mitigation without ads. 3. Avast Free Antivirus: Offers additional tools like network scanning and a Do Not Disturb mode for gaming. 4. AVG AntiVirus Free: Features a simpler interface, link and attachment protection, and fewer pop-ups. 5. TotalAV Free Antivirus: A newer option with a clean interface, real-time protection, and a junk file cleaner. Key factors to consider when selecting free antivirus software include real-time protection, low resource usage, minimal intrusion, and extra security tools. While free solutions are suitable for most users, premium protection may be necessary for small businesses or those handling sensitive data. For gamers, Bitdefender and Avast are recommended for their low system impact and gaming modes. For remote workers, Microsoft Defender and TotalAV are highlighted for their ease of use and integrated protections. Essential features of effective antivirus programs include robust virus protection, real-time scanning, and a behavior shield to detect new threats. Performance should not significantly slow down the system, and the interface should be user-friendly. Experts recommend Windows Defender for basic protection, with AVG and Avast receiving endorsements for their feature balance, while Bitdefender Free is noted for its detection rates and minimal system impact. Free antivirus programs may lack advanced features and technical support compared to paid versions.

Winsage

March 28, 2025

Windows Users at Risk: New Zero-Day Exploit Steals Passwords Without Interaction

A newly uncovered zero-day vulnerability in Windows allows hackers to steal NTLM credentials simply by previewing a malicious file, affecting multiple Windows versions, including Windows 7 and Windows 11 v24H2. Microsoft has not yet issued a patch for this vulnerability, leaving millions of users exposed. The flaw was reported by security researcher Mitja Kolsek from ACROS Security, who noted that stolen credentials could lead to unauthorized access to networks. ACROS Security has created a temporary micro-patch available through its 0patch platform, which users are encouraged to implement. Additionally, a separate zero-day vulnerability identified in Google Chrome and other Chromium-based browsers allows attackers to bypass sandbox protection with a click on a malicious link, primarily targeting media organizations and government agencies in Russia. Users are advised to install the 0patch fix, avoid interacting with unfamiliar files, and update their browsers to protect against these threats.

Winsage

March 26, 2025

New Windows 0-Day Vulnerability Let Remote Attackers Steal NTLM Credentials

A critical vulnerability affecting various Windows operating systems, including Windows 7, Server 2008 R2, Windows 11 v24H2, and Server 2025, allows attackers to capture NTLM authentication credentials through interactions with malicious files in Windows Explorer. Exploitation can occur when users open shared folders, insert USB drives with malicious files, or view downloaded files. The vulnerability is similar to a previously patched flaw (CVE-2025-21377) but has not been fully documented. Security researchers have developed micropatches available for free until Microsoft releases a permanent fix. These micropatches support a wide range of Windows versions, including legacy and currently supported systems. The micropatches have been automatically distributed to affected systems with the 0patch Agent installed.