The hackers behind the Mispadu banking trojan are exploiting a vulnerability that allows Windows SmartScreen to be bypassed . The vulnerability has been patched, but hackers are using it on vulnerable systems and targeting users in Mexico .
In these recent attacks, a new variant of the Mispadu malware has also been detected, according to Palo Alto Networks.
Mispadu is spread through phishing emails . It is an information- stealing malware that targets victims in the Latin American region. In March 2023, Metabase Q revealed that campaigns related to Mispadu had collected at least 90,000 bank account credentials since August 2022.
See also: Grandoreiro Banking Trojan: Brazilian authorities arrest those responsible
The latest infection chain detected by Palo Alto Networks' Unit 42 uses internet shortcut files contained in fake ZIP archive files that exploit the CVE-2023-36025 (CVSS score: 8.8). This is the Windows SmartScreen bypass vulnerability that was patched by Microsoft in November last year.
“ This exploit revolves around creating a special internet shortcut file (.URL) or hyperlink that leads to malicious files that can bypass SmartScreen warnings ,” security researchers Daniela Shalev and Josh Grunzweig said
“The bypass is simple and relies on a parameter that refers to a network share rather than a URL. The generated .URL file contains a link to the attacker's network share with a malicious binary.".
The Mispadu banking trojan selectively targets victims based on their geographic location (i.e. America or Western Europe) and configurations system. It then communicates with a command-and-control (C2) server to extract data.
See also: Chameleon banking trojan: New variant bypasses biometric checks
In recent months, the vulnerability in Windows SmartScreen has been exploited by many hackers (e.g. to deliver DarkGate and Phemedrone Stealer malware).
Mexico is also a top target for many cybercriminals.
Protection from banking trojans
To protect yourself from Banking Trojans, such as Mispadu, it is vital to software security your device's. This includes installing the latest updates and patches provided by the manufacturer of the operating system and security software.
Additionally, it is important to use a reliable antivirus and anti-malware program . should This providereal-time protection and be able to detect and remove Banking Trojans.
See also: 10 new Android banking trojans appeared in 2023
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
You should also be careful with the emails and messages you receive. Many Banking Trojans are spread through phishing emails that try to trick users into clicking on dangerous links.
Finally, avoid downloading apps that look suspicious. If they ask for more permissions than they need to function properly, don't download them to your device.
Source: thehackernews.com
