Facebook accounts are once again at risk of attacks as researchers encounter two new variants of NodeStealer malware. These variants were part of phishing attacks launched in December 2022. While the campaign is no longer active, Palo Alto’s Unit 42 researchers believe that there may be ongoing effects for previously compromised organizations.
Attack process
- Threat actors used multiple Facebook business pages and user profiles to post materials related to the respective businesses.
- These posts lured victims to download a link from known cloud file storage providers.
- After clicking on the link, a .zip file was downloaded which resulted in the execution of NodeStealer.
About the variants
- Written in Python language, the NodeStealer variants come with the ability to steal users’ information by taking complete control over Facebook Business accounts.
- These variants can download additional malware, pilfer browser data, and maximize financial gain by stealing Metamask credentials from Chrome, Cốc Cốc, and Brave browsers.
- They include several anti-analysis capabilities such as disabling Windows Defender to stay under the radar during the infection process.
Attribution
- Researchers suspect Vietnam-based threat actors behind the new NodeStealer variants. The claims are based on the Python scripts written in Vietnamese.
- The second indication is that the attackers are known for targeting the Cốc Cốc browser that is widely used in Vietnam.
- In addition to the above, the attackers attempt to purchase an online mailbox service from two different Vietnamese websites - a feature associated with the second variant of NodeStealer.
Conclusion
The latest campaign adds to the growing trend of threat actors targeting Facebook accounts. This type of attack can cause both financial and reputational damage to individuals and organizations. Facebook business account owners are encouraged to use strong passwords and enable MFA.
Publisher
/https://cyware-ent.s3.amazonaws.com/image_bank/35c6_shutterstock_1065428879.jpg)
/https://cyware-ent.s3.amazonaws.com/image_bank/dac3_shutterstock_2235244993.jpg)
