3 ms·

The stealers are spread some other way, discord is used as a place to send the attacker stolen info. Back in the day IRC bots were used in the same way. The re

by _8j50 3y ago

The stealers are spread some other way, discord is used as a place to send the attacker stolen info. Back in the day IRC bots were used in the same way. The recent discord change affects a different type of abuse though. The attackers upload their malware to discord and use the link to that attachment as part of the infection/dropper phase. Let's say you get a phishing link, a social media post such as on facebook,linkedin,etc... or a search result on google, malvertising,etc... then that lets you download the desired content except it's an iso,archive, lnk,etc... you open it and the file in it. Little do you know that triggere the infection where powershell, wscript, csc or whatever else is downloading the malware using the discord permalink, if it is any good it will still need additional unpacking and decrypting before it either settles in its new home on your computer or if it is a stealer, it grabs your browser stored passwords (never use that or login to chrome/edge!!! Or mix work/personal accounts!!) , crypto wallets, api keys , interesting files such as config files, credit cards (again browsers lol) and more and posts that data archived using a webhook to the attackers channel/room and the malware will not even touch your disk before disappearing sometimes (reflective .net assembly loading, Thread injection,etc...) If you have relatives who are not technical, either make them use macos or turn on defender with tamper protection and cloud delivered protection and make sure extensions and hidden files are visible by default. Also change the default file association for js,jse,vbs,vbe,iso,7z,rar,hta,bat,cmd and I am sure I am missing more to notepad.

0xDEAFBEAD 3y ago
Thanks for the explanation! You write: >it grabs your browser stored passwords (never use that or login to chrome/edge!!! Or mix work/personal accounts!!) I actually don't know a ton about the Windows permissions model. If the malware can already install a keylogger at this point, doesn't avoiding the use of stored passwords just delay the inevitable? (I guess installing a keylogger could cause it to be detected by antivirus software?) Also, in terms of mixing work and personal accounts -- it's not enough to use separate browsers, I'd have to use separate devices, correct? What are reflective .net assembly loading & thread injection? That's quite a list of file extensions! It seems like Windows is astonishingly willing to execute unwanted code. Like, I'm struggling to imagine why I'd be significantly worried about a downloaded .js file on Linux/macOS.
- _8j50 3y ago
  > If the malware can already install a keylogger at this point, doesn't avoiding the use of stored passwords just delay the inevitable? Browsers sync passwords. all the passwords you saved to everything get exposed to the malware. Most services you use regularly these days don't require frequent logins on the same device either. For example, you may only login to your school/work at a different pc but you sync passwords on the same google account because you also check your personal email there. Now any malware at any of those devices gets your saved password and payment info. Not to mention session cookies! > I guess installing a keylogger could cause it to be detected by antivirus software? Maybe, maybe not but the av might clean it up before it gets any creds keylogged. Part of the secuity model for password managers too. > Also, in terms of mixing work and personal accounts -- it's not enough to use separate browsers, I'd have to use separate devices, correct? Yes, and avoid allowing chrome and edge to sync stuff, it's very useful for attackers lol. > What are reflective .net assembly loading & thread injection? I am sure a google search would be better than me trying to explain those in depth here. Basically you can execute code in memory without having to store the code anywhere on disk, it helps with cheaper av that focus more on disk and registry than memory and api call hooking. > Like, I'm struggling to imagine why I'd be significantly worried about a downloaded .js file on Linux/macOS. On windows by default .js is not javascript but jscript, a native script langauge similar to javascript used a lot before powershell was a thing. The windows script host (wscript.exe) will attempt to execute any .js files you double click on by default
  - 0xDEAFBEAD 3y ago
    Thanks for the details!

by _8j50 3y ago

0xDEAFBEAD 3y ago

Thanks for the explanation! You write: >it grabs your browser stored passwords (never use that or login to chrome/edge!!! Or mix work/personal accounts!!) I actually don't know a ton about the Windows permissions model. If the malware can already install a keylogger at this point, doesn't avoiding the use of stored passwords just delay the inevitable? (I guess installing a keylogger could cause it to be detected by antivirus software?) Also, in terms of mixing work and personal accounts -- it's not enough to use separate browsers, I'd have to use separate devices, correct? What are reflective .net assembly loading & thread injection? That's quite a list of file extensions! It seems like Windows is astonishingly willing to execute unwanted code. Like, I'm struggling to imagine why I'd be significantly worried about a downloaded .js file on Linux/macOS.

_8j50 3y ago
> If the malware can already install a keylogger at this point, doesn't avoiding the use of stored passwords just delay the inevitable? Browsers sync passwords. all the passwords you saved to everything get exposed to the malware. Most services you use regularly these days don't require frequent logins on the same device either. For example, you may only login to your school/work at a different pc but you sync passwords on the same google account because you also check your personal email there. Now any malware at any of those devices gets your saved password and payment info. Not to mention session cookies! > I guess installing a keylogger could cause it to be detected by antivirus software? Maybe, maybe not but the av might clean it up before it gets any creds keylogged. Part of the secuity model for password managers too. > Also, in terms of mixing work and personal accounts -- it's not enough to use separate browsers, I'd have to use separate devices, correct? Yes, and avoid allowing chrome and edge to sync stuff, it's very useful for attackers lol. > What are reflective .net assembly loading & thread injection? I am sure a google search would be better than me trying to explain those in depth here. Basically you can execute code in memory without having to store the code anywhere on disk, it helps with cheaper av that focus more on disk and registry than memory and api call hooking. > Like, I'm struggling to imagine why I'd be significantly worried about a downloaded .js file on Linux/macOS. On windows by default .js is not javascript but jscript, a native script langauge similar to javascript used a lot before powershell was a thing. The windows script host (wscript.exe) will attempt to execute any .js files you double click on by default
- 0xDEAFBEAD 3y ago
  Thanks for the details!