Raccoon and Vidar spread via cracked software links

Share post:

Since early 2020, more than 250 domains have been used in a widespread impersonation campaign aimed at disseminating the information-stealing malware Vidar and Raccoon.

Both pieces of malware are capable of stealing a wide range of personal information from compromised machines, as well as credentials from web browsers and data from various cryptocurrency wallets.

The infection chain “uses about a hundred of fake cracked software catalogue websites that redirect to several links before downloading the payload hosted on file share platforms, such as GitHub,” cybersecurity firm SEKOIA said in an analysis.

The attackers take advantage of users looking for cracked versions of software and games on search engines by displaying malicious websites on the first page. To trick victims into downloading and executing the malicious payloads, it employs a technique known as search engine optimization (SEO) poisoning.

The tainted result includes a download link to the promised software, which, when clicked, initiates a five-stage URL redirection pattern that takes the user to a web page showing a shortened link pointing to a password-protected RAR archive file hosted on GitHub, along with its password. If the victim uncompresses the RAR archive and runs the purported setup executable, either of the two malware families, Raccoon or Vidar, is installed on the system.

The sources for this piece include an article in TheHackerNews.

SUBSCRIBE NOW

Related articles

Sleeper Supply Chain Attack Activates After 6 Years

A coordinated supply chain attack has compromised between 500 and 1,000 e-commerce websites by exploiting vulnerabilities in 21...

Russian-Controlled Open Source Tool Raises Alarms Over U.S. Cybersecurity

A widely used open-source Go library, easyjson, used in healthcare, finance and even defence has come under scrutiny...

Signal Archiving Tool Used By Trump Admin Is Breached, Raising Alarms Over Messaging Security (EDITORIAL)

(EDITORIAL) A messaging tool used by Trump administration officials to archive encrypted Signal messages has been hacked —...

Anthropic Warns: AI “Virtual Employees” Could Pose Security Risks Within a Year

Anthropic, a leading artificial intelligence company, anticipates that AI-powered virtual employees could begin operating within corporate networks as...

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways