Hackers have compromised Facebook business accounts and are using them to display fake ads that use “revealing photos of young women” as bait. The goal is to attract Facebook users and trick them into downloading an updated version of the NodeStealer malware.
“ Clicking on ads directly downloads a file containing a malicious .exe 'Photo Album' file, which also installs a second .NET executable – this payload is responsible for stealing browser cookies and passwords ,” Bitdefender said
See also: North Korean hackers target blockchain engineers with Kandykorn malware
The NodeStealer malware was first discovered by Meta in May 2023. It was designed to steal Facebook accounts. Since then, the threat behind the malware have used a Python-.
The malware is part of a growing cybercrime ecosystem in Vietnam, where many cybercriminals leverage overlapping methods that primarily involve advertisements to distribute malware.
In the latest campaign discovered by the Romanian cybersecurity, attackers are also using malicious ads to compromise users Facebook accounts.
See also: Mozi malware botnet: Deactivated by mysterious kill-switch
“Meta’s Ads Manager tool is actively leveraged in these campaigns to target male Facebook users aged 18 to 65 from Europe, Africa and the Caribbean,” Bitdefender said. “Men aged 45+ are primarily affected.”
In addition to distributing malware via Windows executables disguised as photo albums, the attacks have expanded their targeting to include ordinary Facebook users
The ultimate goal of the attacks is to leverage stolen cookies to bypass security mechanisms, such as two-factor authentication, and change passwords, thereby locking users out of their accounts.
Attackers may steal money or defraud new victims through the compromised accounts.
See also: “Meal Kits” Malware Used for RAT Attacks
Facebook account protection
To protect your Facebook accounts from NodeStealer malware, you should follow some basic security practices:
- Use a strong and unique password for account . This password should include lowercase and uppercase letters, numbers, and special characters. You should also change your password regularly to prevent unwanted access to your account.
- Use multi-factor authentication. This means that in addition to your password, you will need to enter an additional code. This makes it much more difficult for malicious attackers to access your account.
- Update your software and security programs regularly. Updates often include fixes for known security and enhance your system's protection.
- Avoid downloading apps and software from untrusted sources and don't click on ads and links that look suspicious.
- Stay informed about new threats cyberso you can be more careful with your movements.
Source: thehackernews.com
