SecurityWeek reports that widely used Windows text and code editing software EmEditor has been compromised in a supply chain intrusion that enabled information-stealing malware deployment.
Threat actors behind the campaign have modified the URL behind the "Download Now" button on the EmEditor homepage to redirect to a nefarious .msi file with the same name and size as the original installer but with a certificate from a different firm, according to an advisory from Emurasoft, the developer of EmEditor.
Additional findings from Chinese cybersecurity firm Qianxin revealed that the .msi file features a script that obtained not only system data but also VPN configurations, Windows and other apps' credentials, and browser-stored information.
Information gathering activities are then followed by the delivery of the infostealer under the guise of the Google Drive Caching extension, which moves to pilfer browser cookies, bookmarks, and history, as well as other system details, while conducting clipboard hijacking, keystroke logging, and Facebook ad account exfiltration.
Threat actors behind the campaign have modified the URL behind the "Download Now" button on the EmEditor homepage to redirect to a nefarious .msi file with the same name and size as the original installer but with a certificate from a different firm, according to an advisory from Emurasoft, the developer of EmEditor.
Additional findings from Chinese cybersecurity firm Qianxin revealed that the .msi file features a script that obtained not only system data but also VPN configurations, Windows and other apps' credentials, and browser-stored information.
Information gathering activities are then followed by the delivery of the infostealer under the guise of the Google Drive Caching extension, which moves to pilfer browser cookies, bookmarks, and history, as well as other system details, while conducting clipboard hijacking, keystroke logging, and Facebook ad account exfiltration.
