Hackers use RedLine Stealer to steal credentials

A campaign with the malware is targeting Russian entrepreneurs who use unlicensed copies of corporate software to automate business processes.

Hackers are distributing an infected version of HPDxLIB, inside which the RedLine Stealer is well hidden.

See also: New Skimmer malware steals credit card data

The campaign reportedly began in January 2024 and remains active, threatening users of pirated software. Kaspersky notes that hackers post malicious triggers on accounting forums, providing instructions for bypassing license checks, without disclosing the existence of the malware.

Users are asked to disable security settings and add the infected files to exceptions in order for the pirated software to work.

The malicious version of HPDxLIB is developed in .NET and uses a self-signed certificate, unlike the legitimate version, which is written in C++ and comes with a valid certificate.

Read more: NordLayer adds malware detection tool

When executed, the malware replaces the techsys.dll library with a modified version that loads RedLine Stealer via the 1cv8.exe process. This software is designed to steal data from messaging apps, browsers, and the victim's system itself.

RedLine Stealer is available through a Malware-as-a-Service (MaaS), allowing attackers to purchase it or sign up for subscriptions. The campaign is specifically targeting businesses, rather than individual users, which makes it stand out.

See also: Dell Power Manager vulnerability allows malicious code execution

This campaign highlights the serious risks associated with the use of pirated software and activators. Businesses are urged to avoid using unlicensed programs in order to protect themselves from such threats and ensure the security of their data.

Source: cybersecuritynews