Malware, Threat Intelligence, Phishing

Crypto drainers spread via hijacked Netgear, Hyundai X accounts

BleepingComputer reports that Netgear and Hyundai Middle East & Africa had their official accounts on X, formerly Twitter, compromised to facilitate the distribution of cryptocurrency wallet drainer malware. Threat actors who took over Netgear's X account on Jan. 6 have leveraged the account to reply to tweets from BRCapp that sought to deceive followers into entering a site purporting to offer $100,000 to the first thousand users who connect their cryptocurrency wallets but instead exfiltrates all of the victims' stored NFTs and other assets. Similar cash offers were made by attackers who hijacked Hyundai MEA's account to spoof the cross-platform multiplayer role-playing game Overworld. Crypto drainer lures have already been removed by Hyundai MEA but Netgear has yet to recover its account. Such a development follows the increasing compromise of verified X accounts belonging to businesses and governments to spread cryptocurrency scams, with Mandiant, CertiK, and Bloomberg Crypto among the most recent victims.

Related

Updated PlugX malware launched in new RedDelta attacks

Attacks by RedDelta commence with spear-phishing emails using Mongolian flood protection, Taiwanese presidential candidate Terry Gou, and an Association of Southeast Asian Nations meeting as lures that contain malicious MSI, MSC, and LNK files to facilitate PlugX malware compromise, according to an analysis from Recorded Future's Insikt Group.

Bogus LDAPNightmare PoC exploit enables infostealer deployment

Executing the bogus exploit — which is based on the legitimate PoC created by SafeBreach Labs but contains the UPX-packed poc.exe file — launches a PowerShell script in the targeted system's %Temp% folder that establishes a script-executing scheduled job to facilitate the eventual retrieval of the infostealing payload, according to a Trend Micro analysis.

CrowdStrike spoofed in recruitment phishing scam

Intrusions discovered earlier this week commenced with the delivery of a malicious email purporting to be from a CrowdStrike employment agent that includes a link for downloading an employee CRM app, which when clicked redirected to a CrowdStrike-spoofing website offering Windows and macOS versions of the app, according to CrowdStrike.

Related Events

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms of Use and Privacy Policy.

Related Terms

AdwareCorruptionDarknetData MiningDictionary AttackDrive-by DownloadDumpSecDumpster DivingGoogle HackingInformation Warfare

You can skip this ad in 5 seconds