Cybersecurity Threat: HijackLoader and DeerStealer

Summary

Threat actors are using HijackLoader and DeerStealer in a new wave of cyberattacks. These attacks utilize phishing tactics, often involving ClickFix redirects, to trick victims into running malicious commands. This leads to the installation of DeerStealer, a powerful information stealer targeting sensitive data, including cryptocurrency wallets and credentials from various applications.

Protect your data without breaking the bankTrueNAS combines award-winning quality with cost efficiency.

** Main Story**

Cybersecurity Under Siege: HijackLoader and DeerStealer Unleashed

A new wave of cyberattacks is targeting unsuspecting victims with the dangerous combination of HijackLoader and DeerStealer. This sophisticated attack chain employs phishing tactics and leverages the Windows Run prompt to deliver its malicious payload. Cybersecurity researchers are urging users to stay vigilant and adopt proactive security measures to protect themselves from these evolving threats.

The ClickFix Phishing Gambit

The attack typically begins with a phishing attempt, often using the ClickFix social engineering tactic. Victims are redirected to a fake ClickFix page, a platform designed to report and track non-emergency issues. This page tricks users into running a seemingly harmless PowerShell command through the Windows Run prompt (Win+R). However, this command downloads a malicious Microsoft Installer (MSI) file, typically named “now.msi”. This file acts as the entry point for the malware.

HijackLoader: The Stealthy Loader

The downloaded MSI file initiates a complex infection chain. It drops files into the C:\ProgramData directory and hijacks a legitimate, digitally signed binary, often from a trusted source like COMODO Internet Security. This allows the attackers to bypass security checks. It loads a modified, unsigned DLL (Dynamic Link Library) file, like cmdres.dll, which redirects execution flow through a hooked C runtime (CRT) function to launch HijackLoader.

HijackLoader uses steganography, the art of concealing information within other data, to hide its encrypted configuration within PNG images. This makes it difficult to detect the malware through traditional security scans. The loader then exploits legitimate binaries to execute the unsigned, malicious code, ultimately injecting DeerStealer into the system’s memory. Despite tools existing to decode HijackLoader’s configurations, attackers persistently use the same methods. This indicates either a lack of awareness among threat actors, or a blatant disregard for detection risks.

DeerStealer: The Information Thief

DeerStealer, marketed as XFiles Spyware on dark web forums by a user named “LuciferXfiles,” is a subscription-based information stealer with far-reaching capabilities. It goes beyond basic credential theft, targeting a wide range of sensitive data:

• Browser Data Extraction: Extracts data from over 50 web browsers, including cookies, passwords, autofill information, and credit card details.
• Cryptocurrency Wallet Hijacking: Monitors the clipboard for cryptocurrency wallet addresses and replaces them with the attacker’s address, effectively hijacking transactions. It targets over 14 different cryptocurrency wallet types.
• Credential Harvesting: Steals credentials from various applications, including messengers, FTP clients, VPNs, email clients, and gaming platforms.
• Remote Access: Includes a hidden VNC (Virtual Network Computing) module for stealthy remote access to the compromised system.
• Secure Communication: Uses encrypted HTTPS channels for command-and-control (C2) communication, making it difficult to intercept and analyze the malware’s activity.

Evolving Threat Landscape

DeerStealer continues to evolve, with planned features including macOS support, AI-driven enhancements, and expanded targeting of additional applications. The malware is sold on a tiered subscription basis with higher tiers offering features like re-encryption, payload signing, and advanced customization. These advancements increase the malware’s potency and pose a growing threat to individuals and organizations alike. It is imperative that security professionals implement comprehensive cybersecurity measures to mitigate the risks posed by this dangerous combination of HijackLoader and DeerStealer.

Protecting Yourself and Your Organization

To defend against these threats, it is crucial to adopt a proactive security posture. Here are some key recommendations:

• Continuous Threat Monitoring: Implement robust threat monitoring solutions to detect and respond to suspicious activities in real-time.
• Endpoint Protection: Deploy up-to-date endpoint protection software with advanced malware detection capabilities.
• Security Awareness Training: Educate users about phishing tactics and the risks of running unknown commands or downloading files from untrusted sources.
• Regular Software Updates: Keep all software and operating systems updated with the latest security patches.
• Multi-Factor Authentication: Enable multi-factor authentication wherever possible to add an extra layer of security to accounts.

As cyber threats become increasingly sophisticated, staying informed and implementing robust security measures is paramount to protecting against data breaches and information theft.