Pirated streaming sites movie are used by millions of users. Microsoft says this phenomenon is even more common these days due to the forced lockdown. But cybercriminals are taking advantage of this situation to infect potential victims with malware delivered via fake movie torrents.
"As lockdowns continue to be in place in many parts of the world, attackers are paying attention to the increase in the use of pirated streaming sites and torrent downloads," the Microsoft research team said.
“We saw a mining campaign cryptocurrency that injects a malicious VBScript into files ZIP posing as movie downloads.”
Fake movies install coin miners in memory
The attackers behind this campaign are primarily targeting home users from Spain and some South American countries. Their goal is to install a coinminer into the compromised device's memory.
The malicious VBScript is “camouflaged” using popular Hollywood movies such as: John Wick: Chapter 3 – Parabellum and is delivered using file names such as “John_Wick_3_Parabellum” and “contagio-1080p”, as well as Spanish titles: “Punales_por_la_espalda_BluRay_1080p”, “La_hija_de_un_ladron” and “Lo-dejo-cuando-quiera”.
If victims run VBScript on their computers, it will begin installing other malicious payloads in the background, exploiting living-off-the-land binaries (LOLbins) , such as the legitimate command-line tool BITSAdmin .
One of these additional malicious components is an AutoIT script that decodes a second-stage DLL into the infected computer's memory, which will then load a third DLL that injects cryptocurrency mining code.
"The use of torrent downloads is consistent with our observation that attackers are reusing old techniques to take advantage of the current crisis," Microsoft added.
Oscar-winning films are also being used as bait for phishing attacks
Attackers are also exploiting films Oscar-winning to lure users and infect them with malware. They may also lure them to phishing pages to steal financial and personal information.
This is nothing new, of course. Popular movies and TV shows are often used as bait for social engineering. Often, hackers promise movie previews on pirated streaming sites, while in reality they infect victims' computers with malware.
Kaspersky researchers found more than 20 phishing websites and 925 malicious files that were presented as free movies, only to attack the user .
"To avoid falling victim to fraud, do not use pirated streaming sites, but legal ones, to ensure that you can enjoy a nice evening in front of the TV without having to worry about various threats," the researchers said.
