Malware targeting firmware is crossing alarming new thresholds. Security researchers unveiled a UEFI bootkit proof-of-concept capable of compromising the Windows kernel during the boot process. Operating beneath traditional antivirus protections, this bootkit showcases the dangers of persistent threats that survive reboots. Secure boot configurations and firmware updates are vital defenses against such sophisticated exploits.

LegionLoader, a malware that has evolved since its 2019 debut, is proving to be a formidable threat. Known also as Satacom and CurlyGate, it deploys malicious tools like Chrome extensions, spreads via drive-by downloads, and uses encryption to evade detection. Its primary targets include financial accounts and sensitive user data.

A new vulnerability called DoubleClickjacking has emerged, introducing a clever twist to traditional clickjacking attacks. Exploiting the timing between double clicks, this technique bypasses security measures like X-Frame-Options.

Top Malware Reported in the Last 24 Hours

UEFI bootkit targets Windows kernel

A proof-of-concept UEFI bootkit was created by security researchers NSG650 and Pdawg. The bootkit exploits a critical firmware function to compromise the Windows kernel during the boot process, demonstrating the increasing sophistication of malware targeting UEFI. It operates at a level beneath traditional antivirus protections and can persist through reboots, making it particularly dangerous. To defend against such threats, organizations should ensure secure boot settings are properly configured and firmware is regularly updated.

The evolution of LegionLoader

TRAC Labs has released a detailed report on LegionLoader, a sophisticated downloader malware that has evolved significantly since its first appearance in 2019. Also known as Satacom, RobotDropper, and CurlyGate, LegionLoader demonstrates a wide range of capabilities, including deploying malicious tools like Chrome extensions, spreading through drive-by downloads, and using multiple layers of encryption to evade detection. The malware targets financial accounts and sensitive user data, with the ability to evade detection through API hammering and encrypted communication with its C2 servers.

Top Vulnerabilities Reported in the Last 24 Hours

New DoubleClickjacking exploit discovered

Threat hunters have identified a new vulnerability called DoubleClickjacking that uses a double-click sequence to conduct clickjacking attacks and gain access to accounts on many major websites. This approach allows new attacks that bypass known protections like the X-Frame-Options header, SameSite cookies, and CSP. DoubleClickjacking takes advantage of the timing between the first and second clicks to bypass security. The attacker-controlled site prompts users to double-click, while the malicious site redirects to a harmful page. 

PoC exploit issued for LDAP bug

SafeBreach Labs developed a zero-click PoC exploit that crashes unpatched Windows Servers by leveraging a vulnerability in the Lightweight Directory Access Protocol (LDAP). This vulnerability, assigned CVE-2024-49112, poses a severe security threat, especially for Active Directory Domain Controllers, as it could lead to remote code execution. The exploit does not require any pre-requisites other than internet connectivity for the victim's DNS server.

Top Scams Reported in the Last 24 Hours

35 Chrome extensions hijacked - How?

New details have come out about a phishing attack aimed at developers of Chrome browser extensions, resulting in at least 35 extensions being compromised with code designed to steal data. The attack involved a sophisticated OAuth application presented as a legitimate authorization request from Google. Even those with MFA could be fooled, as the process didn’t prompt them for additional verification. Once attackers gained access, they introduced malicious files to the extensions, allowing them to steal Facebook account information from users of these extensions. These compromised extensions would then be published on the Chrome Web Store with the added malicious code designed to bypass Facebook's 2FA and exfiltrate sensitive user data to the attackers’ server.