Downloading software illegally? You might want to check your bank account

Downloading software illegally? You might want to check your bank account

Saving might actually come with a bigger price - new research reveals hard to detect malware in installers designed to steal sensitive info.

Published on 13th January 2025

Those who don’t fancy paying for Photoshop, Lightroom, AutoCAD, or other software might be tempted to use cracks available on the internet. This small piece of code can break software protection and allow you to use it for free.

Researchers from the security firm Trend Micro have unveiled a scheme in which attackers spread fake installers packed with hardly detectable and information-stealing malware via YouTube and other social media platforms.

Once the user clicks on a malicious link, which often appears in search results or comments on various social media platforms, a compressed file is downloaded from reputable file hosting sites such as Mediafire or Mega.nz.

What seems to be a legitimate software installer actually contains malware, categorized as an infostealer. This type of malware is designed to steal sensitive information from an infected system.

This can include your credentials, financial information, personal data, and other sensitive information. Threat actors can exploit such data for identity theft, fraud, or other malicious purposes.

Malicious links on OpenSea and Soundcloud

In their report, researchers show examples of malicious links with malware promoted on the least expected platforms, such as the NFT marketplace OpenSea or the sharing platform SoundCloud.

For example, if a user searches for Autodesk Keygen, a program that generates product serial numbers, the search results show the credible looking sites above. The entry on OpenSea contained a shortened link that redirects the user to the actual malicious link. The entry on SoundCloud also hosted the shortened download link with a corresponding description.

Threat actors might use shortened links to prevent scraping sites from accessing the download link.

How does malware evade detection?

There are a couple of ways that this malware manages to evade detection. Firstly, threat actors often use reputable file hosting services to conceal the origin of their malware and make detection and removal more difficult. Most antivirus programs will only detect malware if the exact link is discovered before the download.

Also, many malicious downloads are password-protected, encoded, and weigh 900MB in size, which complicates analysis in security environments such as sandboxes. Furthermore, such big files can not be uploaded to VirusTotal, allowing the malware to evade early detection.

The operation uses legitimate files and relies on techniques like DLL sideloading or process injection to run its payload. The Infostealers discovered were:

Source

Image Credit

ticklishpanda123 via Vecteezy

The latest updates straight to your inbox

We just need a few details to get you subscribed

Health Checks

Inventory & Compliance

Cloud Readiness & Optimisation

Agreement & Audit Support

Learning

Looking for something specific?

Let's see what we can find - just type in what you're after

Wait! Before you go

Have you signed up to our newsletter yet?

It’s chock full of useful advice, exclusive events and interesting articles. Don’t miss out!

Cookie Notice

Our website uses cookies to ensure you have the best experience while you're here.