A threat actor named Markopolo has been identified as the mastermind behind a large-scale scam.
This scam targets digital currency users on social media, using information-stealing malware and carrying out cryptocurrency.
See more: New phishing service ONNX targets Microsoft 365 accounts
The attacks include the use of a purported virtual meeting software called Vortax (and 23 other applications) as a means to deliver Rhadamanthys, StealC, and Atomic macOS Stealer (AMOS), according to an analysis by Recorded Future's Insikt Group published this week.
“This campaign, which primarily targets cryptocurrency users, marks a significant increase in macOS security threats and reveals an extensive network of malicious applications,” the cybersecurity.
There is evidence linking the Vortax campaign to previous activities that used phishing to target macOS and Windows users via Web3 gaming baits.
A critical aspect of the malicious enterprise is Vortax’s attempt to legitimize itself on social media and the internet, with the actors maintaining a Medium blog filled with suspicious AI-, as well as a verified account on X (formerly Twitter) with a gold checkmark.
Installing the booby-trapped app requires victims to provide a RoomID, a unique identifier included in meeting invitations, which are spread via replies to the Vortax account, direct messages, and Discord and Telegram channels. Once the user enters the necessary RoomID on the Vortax website, they are redirected to a Dropbox link or an external website, where an installer prepares the software, ultimately leading to the deployment of the stealing malware.
Read also: Vulnerabilities in VMware: Threats and ways to protect
«The threat actor handling this campaign, known as markopolo, leverages shared hosting and C2 infrastructure for all versions», Recorded Future reported.
The findings highlight that the pervasive threat of malware cannot be ignored, especially in light of the recent campaign targeting Snowflake. Meanwhile, Enea has uncovered the abuse of cloud by fraudsters, including Amazon S3, Google Cloud Storage, Backblaze B2 and IBM Cloud Object Storage, to trick users into clicking fake links that lead to phishing landing pages that collect data .
“Cybercriminals have found a way to exploit the ability of cloud storage to host static websites, usually .HTML files, that contain spam URLs embedded in their source code,” said security researcher Manoj Kumar. “The URLs linked to cloud storage are distributed via messages, which appear genuine and can therefore bypass firewall. When mobile users click on these links, which contain known cloud platform domains, they are directed to the static website stored in the storage bin.”
In the final stage, the website automatically redirects users to embedded malicious URLs or URLs generated via JavaScript, tricking them into revealing personal and financial information.
See also: Warmcookie malware promoted via fake job offers
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
“Because the main domain of the URL includes, for example, the authentic Google Cloud Storage URL/domain , it is difficult to detect through standard URL scanning,” Kumar said. “Detecting and blocking URLs of this type is an ongoing challenge due to their association with legitimate domains owned by trusted companies.”
Source: thehackernews
