COVID-Themed Phishing Campaigns Spread RedLine Stealer via Fake Omicron and Folding@home Apps
Malware Intelligence · 3 sources · Updated 2mo ago · First seen Nov 26, 2021
Threat researchers reported multiple COVID-19-themed phishing campaigns distributing the RedLine Stealer malware by disguising payloads as legitimate pandemic-related software and information. In one campaign, attackers used an Omicron Stats.exe lure tied to the Omicron outbreak; in another, they impersonated a coronavirus research effort and pushed a fake Folding@home application named foldingathomeapp.exe. Researchers assessed email as the likely delivery vector, with the campaigns exploiting public anxiety and curiosity around the pandemic to drive downloads.
Once executed, RedLine harvested browser credentials, cookies, credit card and autocomplete data, cryptocurrency wallet artifacts, Telegram and Discord data, and detailed host information. Fortinet said the Omicron-themed sample copied itself into the victim’s roaming AppData directory, established persistence through a scheduled task, and communicated with a command-and-control server at 207.32.217.89:14588 using a distinctive authorization header; Proofpoint and BleepingComputer also noted RedLine receives remote tasking after infection. Victims were observed across at least 12 countries, indicating broad opportunistic targeting rather than a narrowly focused operation.
