Monday, November 25, 2024
Homecyber securityHacker-Attacking Developers Using Weaponized MS Visual Studio

Hacker-Attacking Developers Using Weaponized MS Visual Studio

Published on

Recent reports suggest that threat actors have been spreading malicious versions of Microsoft Visual Studio, a highly familiar Integrated Development Environment (IDE) used by several developers worldwide.

Recently, cybercriminals have been targeting the familiar IDE, Microsoft Visual Studio, with malicious software. This threat, spread by malicious actors, has been detected and is a cause for concern.

This malicious software delivers a cookie stealer capable of stealing sensitive information like browser cookies containing usernames and passwords.

- Advertisement - SIEM as a Service

Developers were targeted as they have access to a lot of sensitive information as part of their job, which can be useful for threat actors to access confidential data and spread malware across servers and networks.

Weaponized MS Visual Studio

This malware consists of a filename “VisualStudio[.]exe” and a Visual Studio Folder that contains the Mainproject[.]exe file a.k.a. Information stealing malware. It is a 32-bit GUI-based .NET executable file.

SHA256 hashes:

Visual Studio.exe – 7e8f18c60e35472bf921d3b67fd427933bd150f57d6e83d1472b990a786976db

MainProject.exe – e8a449e692f1b21f1bc4d49d8b27068b03dd7e8df583d429266fdfb261ddeed5

Visual Studio Installer Bundle with Information Stealer Malware

The installation of the VisualStudio[.]exe also simultaneously prompts the installation of Mainproject[.]exe.

If the user permits the Mainproject[.]exe’s installation, the information stealer malware begins to extract information like Machine name, username, processor bit version, operating system version, platform, and IP address.

Once after extraction of system data is done, it proceeds to exfiltrate cookies from browsers like Google Chrome, Firefox, Opera, and Edge.

Furthermore, the cookie stealer targets acquiring the cookies of famous social media platforms and also generates a separate .txt file for these social media credentials.

All this information extracted is stored in the temp folder on the directory where the installation was executed. These data are then transmitted as a .zip file through Telegram designated bot as part of exfiltration.

Exfiltration through Telegram (Source: Cyble)

Once these processes are done, the malware executes the legitimate vs-professional.exe file and deletes the temp folder to hide its track.

Researchers at Cyble have published a complete report about this malware regarding its operation, source code, and other information.

Users of Microsoft Visual Studio (specifically developers) are recommended to take extra precautions when downloading Microsoft Visual Studio from external sites and be vigilant towards this information-stealing malware.

Stay up-to-date with the latest Cyber Security News; follow us on GoogleNewsLinkedinTwitterand Facebook.

Eswar
Eswar
Eswar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Latest articles

Veritas Enterprise Vault Vulnerabilities Lets Attackers Execute Arbitrary Code Remotely

Critical security vulnerability has been identified in Veritas Enterprise Vault, a widely-used archiving and...

7-Zip RCE Vulnerability Let Attackers Execute Remote Code

A critical security vulnerability has been disclosed in the popular file archiving tool 7-Zip,...

Massive Credit Card Leak, Database of 1,221,551 Cards Circulating on Dark Web

A massive data breach has sent shockwaves across the globe, as a database containing...

Nearest Neighbor Attacks: Russian APT Hack The Target By Exploiting Nearby Wi-Fi Networks

Recent research has revealed that a Russian advanced persistent threat (APT) group, tracked as...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

Veritas Enterprise Vault Vulnerabilities Lets Attackers Execute Arbitrary Code Remotely

Critical security vulnerability has been identified in Veritas Enterprise Vault, a widely-used archiving and...

7-Zip RCE Vulnerability Let Attackers Execute Remote Code

A critical security vulnerability has been disclosed in the popular file archiving tool 7-Zip,...

Massive Credit Card Leak, Database of 1,221,551 Cards Circulating on Dark Web

A massive data breach has sent shockwaves across the globe, as a database containing...