NodeStealer

Ad account theft, the systematic hijacking of Meta Business Manager and Google Ads accounts, has grown into a commodity-driven cybercrime economy... Legitimate ad spend history raises account trust scores, meaning aged, active accounts can serve ads that pass platform safety checks that would reject a new attacker-created account.

The main infection vector for the infostealer was a phishing campaign... The threat actor used multiple Facebook pages and users to post information luring victims to download a link from known cloud file storage providers. After clicking on it, a .zip file was downloaded to the machine, containing the malicious infostealer executable.

Threat actors have moved away from purpose-built malicious infrastructure and toward legitimate, high-reputation sending platforms that email security tools are configured to trust. Mimecast’s telemetry shows that among these campaigns, about one in three detections arrived through Salesforce infrastructure, with another quarter delivered through Google Workspace mail-merge tools and SharePoint-hosted links.

attackers attempt to bypass User Account Control (UAC) and execute the PowerShell scripts used to download the above-mentioned zip files.

After clicking on it, a .zip file was downloaded to the machine, containing the malicious infostealer executable.

Ad account theft, the systematic hijacking of Meta Business Manager and Google Ads accounts, has grown into a commodity-driven cybercrime economy... Legitimate ad spend history raises account trust scores, meaning aged, active accounts can serve ads that pass platform safety checks that would reject a new attacker-created account.

the malware modifies the account email address for the Facebook business account of the victim... If successful, the attackers have now taken over the Facebook account by replacing the legitimate user’s email address with a mailbox under their control.

After downloading and extracting the files, NodeStealer sets persistence for the three pieces of malware... as well as for its own binary (word.exe), via the registry run keys.

Ad account theft, the systematic hijacking of Meta Business Manager and Google Ads accounts, has grown into a commodity-driven cybercrime economy... Legitimate ad spend history raises account trust scores, meaning aged, active accounts can serve ads that pass platform safety checks that would reject a new attacker-created account.

the malware modifies the account email address for the Facebook business account of the victim... If successful, the attackers have now taken over the Facebook account by replacing the legitimate user’s email address with a mailbox under their control.

After downloading and extracting the files, NodeStealer sets persistence for the three pieces of malware... as well as for its own binary (word.exe), via the registry run keys.

the malware implements the FodHelper UAC bypass... attackers attempt to bypass User Account Control (UAC) and execute the PowerShell scripts used to download the above-mentioned zip files.

“The malware is also distributed as compiled Python bytecode with altered header fields, apparently intended to obscure its compilation timeline and possibly interfere with automated analysis.”

The malware then exfiltrates the output files through Telegram and deletes the files to remove its tracks

“It saves captured text in a temporary file, sends it to the primary Telegram command-and-control channel every 120 seconds, and then clears the file’s contents.”

Ad account theft, the systematic hijacking of Meta Business Manager and Google Ads accounts, has grown into a commodity-driven cybercrime economy... Legitimate ad spend history raises account trust scores, meaning aged, active accounts can serve ads that pass platform safety checks that would reject a new attacker-created account.

the threat actor added a simple function to check for the presence of several malware analysis tools and virtual machine processes. If one of them is running on the system, the malware terminates itself.

The latest variant uses the Python ecosystem and incorporates libraries and functionality for: Keyboard monitoring.

The latest variant uses the Python ecosystem and incorporates libraries and functionality for: Browser session/cookie theft.

The latest variant uses the Python ecosystem and incorporates libraries and functionality for: Wi-Fi password collection.

it checks for Facebook users and passwords within the cookies and local databases of the following browsers: Chrome, Edge, Cốc Cốc, Brave and Firefox.

The latest variant uses the Python ecosystem and incorporates libraries and functionality for: Browser credential theft.

the malware extracts the local databases used to store browsers’ information. It searches within them for the extension nkbihfbeogaeaoehlefnkodbefgpgknn... Then, the malware copies the data into a file and exfiltrates it using Telegram

the threat actor added a simple function to check for the presence of several malware analysis tools and virtual machine processes. If one of them is running on the system, the malware terminates itself.

The latest variant uses the Python ecosystem and incorporates libraries and functionality for: File collection from the victim's Pictures directory.

The latest variant uses the Python ecosystem and incorporates libraries and functionality for: Keyboard monitoring.

“It saves captured text in a temporary file, sends it to the primary Telegram command-and-control channel every 120 seconds, and then clears the file’s contents.”

“It saves captured text in a temporary file, sends it to the primary Telegram command-and-control channel every 120 seconds, and then clears the file’s contents.”

The latest variant uses the Python ecosystem and incorporates libraries and functionality for: Screenshot capture.

the malware has a function that parses emails, so it can read the victim’s emails.

The latest variant uses the Python ecosystem and incorporates libraries and functionality for: Clipboard collection.

“One bot receives an archive of browser credentials, passwords, and cookie databases.”

The latest variant uses the Python ecosystem and incorporates libraries and functionality for: Telegram-based command and control.

Variant #1 is configured to download two .zip files... Bat.zip contains the ToggleDefender batch script... Ratkyc.zip contains three pieces of malware

The latest variant uses the Python ecosystem and incorporates libraries and functionality for: Automated data exfiltration.

The malware then exfiltrates the output files through Telegram and deletes the files to remove its tracks

Bat.zip contains the ToggleDefender batch script that disables Windows Defender... Variant #1 uses another technique to disable Windows Defender, this time using the GUI.