Those who don’t fancy paying for Photoshop, Lightroom, AutoCAD, or other software might be tempted to use cracks available on the internet. This small piece of code can break software protection and allow you to use it for free.
Researchers from the security firm Trend Micro have unveiled a scheme in which attackers spread fake installers packed with hardly detectable and information-stealing malware via YouTube and other social media platforms.
Once the user clicks on a malicious link, which often appears in search results or comments on various social media platforms, a compressed file is downloaded from reputable file hosting sites such as Mediafire or Mega.nz.
What seems to be a legitimate software installer actually contains malware, categorized as an infostealer. This type of malware is designed to steal sensitive information from an infected system.
This can include your credentials, financial information, personal data, and other sensitive information. Threat actors can exploit such data for identity theft, fraud, or other malicious purposes.
In their report, researchers show examples of malicious links with malware promoted on the least expected platforms, such as the NFT marketplace OpenSea or the sharing platform SoundCloud.
For example, if a user searches for Autodesk Keygen, a program that generates product serial numbers, the search results show the credible looking sites above. The entry on OpenSea contained a shortened link that redirects the user to the actual malicious link. The entry on SoundCloud also hosted the shortened download link with a corresponding description.
Threat actors might use shortened links to prevent scraping sites from accessing the download link.
There are a couple of ways that this malware manages to evade detection. Firstly, threat actors often use reputable file hosting services to conceal the origin of their malware and make detection and removal more difficult. Most antivirus programs will only detect malware if the exact link is discovered before the download.
Also, many malicious downloads are password-protected, encoded, and weigh 900MB in size, which complicates analysis in security environments such as sandboxes. Furthermore, such big files can not be uploaded to VirusTotal, allowing the malware to evade early detection.
The operation uses legitimate files and relies on techniques like DLL sideloading or process injection to run its payload. The Infostealers discovered were:
ticklishpanda123 via Vecteezy
"*" indicates required fields
Software Asset Management is a business practice that involves managing and optimising the life cycle of software within an organisation.
Software asset management is relevant to many facets of a business - take a look at some of the roles that it can form part of the focus of.
Software vendors come in all shape and sizes - all with their own set of licensing models and rules. We take a look at just a few of them.
As a constantly evolving subject, SAM is not without its challenges. We take a look at some of the most common ones.
Wondering what an investment in SAM could do for your business? Fill out a few details and find out what return you could get!
Answer a few questions about your SAM infrastructure & experience, and we'll put together a personalised recommendation for the future.
A simple health check of what's being used across your Office 365 estate in this FREE, Microsoft backed and easy to setup review.
Just like you would with your vehicle each year, get an annual check up of your software asset management programme.
Overwhelmed by the task of documenting the steps for a successful SAM programme? Get the experts in to help!
Concerned your SAM tools aren't covering your whole estate? Or on the look out for an entirely new tool? Get us in to assist.
Not content with covering all things SAM related, we've teamed up with Capital to provide a comprehensive hardware asset management review.
A simple, one-time reconciliation of the software you have deployed versus the licence entitlement you own.
A regularly scheduled analysis of your organisation's estate, specifically adapted to your needs and budget.
A full appraisal of your Microsoft 365 setup and how best to optimise it through automated recommendations.
An add-on to our SAMplicity One, MOT and Plus offerings, quickly diagnose your ability to migrate your resources to the cloud.
In collaboration with law firm Addleshaw Goddard, ensure the legality of your SAM programme and get assistance with any contract disputes.
Available as standard with SAMplicity Plus, ensure you're compliant if you're unexpectedly audited by a vendor.
We've teamed up with some of the forefront experts in licensing knowledge so you can teach yourself to be an expert too.
Stumped by the continually evolving complexities of SAM? Join us for one of our comprehensive courses, either in-person or online.
It’s chock full of useful advice, exclusive events and interesting articles. Don’t miss out!