NodeStealer

Ad account theft, the systematic hijacking of Meta Business Manager and Google Ads accounts, has grown into a commodity-driven cybercrime economy... Legitimate ad spend history raises account trust scores, meaning aged, active accounts can serve ads that pass platform safety checks that would reject a new attacker-created account.

The main infection vector for the infostealer was a phishing campaign... The threat actor used multiple Facebook pages and users to post information luring victims to download a link from known cloud file storage providers. After clicking on it, a .zip file was downloaded to the machine, containing the malicious infostealer executable.

The infection chain starts with a spear-phishing email with a malicious embedded link, which upon clicking, downloads and installs the malware under the guise of a legitimate application.

Threat actors have moved away from purpose-built malicious infrastructure and toward legitimate, high-reputation sending platforms that email security tools are configured to trust. Mimecast’s telemetry shows that among these campaigns, about one in three detections arrived through Salesforce infrastructure, with another quarter delivered through Google Workspace mail-merge tools and SharePoint-hosted links.

attackers attempt to bypass User Account Control (UAC) and execute the PowerShell scripts used to download the above-mentioned zip files.

As shown in Figure 4, the sideloaded DLL then executes a batch file, images\active-license.bat, using the command prompt (cmd.exe).

Contains a portable Python 3.10 interpreter that will download and execute the final payload... The file entry.txt contains an obfuscated Python script.

Once the user clicks on the embedded malicious link in the email, it triggers the download of a suspicious file named Nombor Rekod 052881.zip. Upon extracting the contents of the zip file, the user inadvertently unleashes several suspicious files onto the system.

After clicking on it, a .zip file was downloaded to the machine, containing the malicious infostealer executable.

Ad account theft, the systematic hijacking of Meta Business Manager and Google Ads accounts, has grown into a commodity-driven cybercrime economy... Legitimate ad spend history raises account trust scores, meaning aged, active accounts can serve ads that pass platform safety checks that would reject a new attacker-created account.

the malware modifies the account email address for the Facebook business account of the victim... If successful, the attackers have now taken over the Facebook account by replacing the legitimate user’s email address with a mailbox under their control.

After downloading and extracting the files, NodeStealer sets persistence for the three pieces of malware... as well as for its own binary (word.exe), via the registry run keys.

Ad account theft, the systematic hijacking of Meta Business Manager and Google Ads accounts, has grown into a commodity-driven cybercrime economy... Legitimate ad spend history raises account trust scores, meaning aged, active accounts can serve ads that pass platform safety checks that would reject a new attacker-created account.

the malware modifies the account email address for the Facebook business account of the victim... If successful, the attackers have now taken over the Facebook account by replacing the legitimate user’s email address with a mailbox under their control.

After downloading and extracting the files, NodeStealer sets persistence for the three pieces of malware... as well as for its own binary (word.exe), via the registry run keys.

the malware implements the FodHelper UAC bypass... attackers attempt to bypass User Account Control (UAC) and execute the PowerShell scripts used to download the above-mentioned zip files.

This batch file images\active-license.bat contains a malicious encoded command... The file entry.txt contains an obfuscated Python script... The script uses the combination of native Python commands exec() and marshal.loads() to execute Python bytecode directly.

The executable file Nombor Rekod 052881.exe, which appears to be a PDF reader – normally recognized as a trusted application – was observed being exploited to sideload the malicious DLL file oledlg.dll.

The malware then exfiltrates the output files through Telegram and deletes the files to remove its tracks

Ad account theft, the systematic hijacking of Meta Business Manager and Google Ads accounts, has grown into a commodity-driven cybercrime economy... Legitimate ad spend history raises account trust scores, meaning aged, active accounts can serve ads that pass platform safety checks that would reject a new attacker-created account.

the threat actor added a simple function to check for the presence of several malware analysis tools and virtual machine processes. If one of them is running on the system, the malware terminates itself.

NodeStealer allowed threat actors to steal browser cookies to hijack accounts on the platform, specifically aiming toward business accounts.

it checks for Facebook users and passwords within the cookies and local databases of the following browsers: Chrome, Edge, Cốc Cốc, Brave and Firefox.

the malware extracts the local databases used to store browsers’ information. It searches within them for the extension nkbihfbeogaeaoehlefnkodbefgpgknn... Then, the malware copies the data into a file and exfiltrates it using Telegram

the threat actor added a simple function to check for the presence of several malware analysis tools and virtual machine processes. If one of them is running on the system, the malware terminates itself.

the malware has a function that parses emails, so it can read the victim’s emails.

It was observed that data exfiltration is carried out through Telegram, where the stolen sensitive information is first compiled into a zip archive.

Capabilities: exfiltrates-data , communicates-with-c2 , steals-authentication-credentials ... this infrastructure consists of this domain ... this file communicates with this domain in STIX2

Variant #1 is configured to download two .zip files... Bat.zip contains the ToggleDefender batch script... Ratkyc.zip contains three pieces of malware

Infrastructure Types: exfiltration , command-and-control ... Capabilities: exfiltrates-data , communicates-with-c2

The malware then exfiltrates the output files through Telegram and deletes the files to remove its tracks

Bat.zip contains the ToggleDefender batch script that disables Windows Defender... Variant #1 uses another technique to disable Windows Defender, this time using the GUI.