Thursday, June 13, 2024

Beware of Facebook Ads That Deliver Password-Stealing Malware

A new malware called Ov3r_Stealer was found to be intended for stealing cryptocurrency wallets and passwords and then sending them to a Telegram channel that the threat actor maintains.

Identified early in December, the malware was spread via a Facebook advertisement for an account manager position. 

The user was directed via weaponized links to a malicious Discord content delivery URL, which triggered the attack’s execution phase.

“The malware is designed to exfiltrate specific types of data such as GeoLocation (based on IP), hardware info, passwords, cookies, credit card information, auto-fills, browser extensions, crypto wallets, Office documents, and antivirus product information,” SpiderLabs shared with Cyber Security News.

Run Free ThreatScan on Your Mailbox

AI-Powered Protection for Business Email Security

Trustifi’s Advanced threat protection prevents the widest spectrum of sophisticated attacks before they reach a user’s mailbox. Try Trustifi Free Threat Scan with Sophisticated AI-Powered Email Protection .

Facebook Ads Delivering Password Stealing Malware

A weaponized PDF file is used for the malware’s first access and transmission. The file impersonates a shared file on OneDrive. A simple clickable OneDrive link was found on a fake Facebook profile purporting to be Amazon CEO Andy Jassy. 

Another instance was seen applying for a Digital Advertising position through a Facebook advertisement.

 Facebook ad for a job in Digital Advertising

Upon selecting the “Access Document” link on the Facebook page, a file ending in .url is downloaded to initiate the subsequent phase. 

SpiderLabs at Trustwave found a quicker way to reach the [.url] in the job notification for “pink women’s magazine” on Facebook by utilizing the PDF file’s information.

The malware was downloaded in three files from a GitHub site utilizing a Powershell script that was run in the victim’s environment and pretended to be Windows Control Panel binary. 

Researchers observed additional ways to install the malware onto the system throughout the malware family study. These methods included HTML smuggling, SVG smuggling, and LNK file masquerading.

After the malware’s three files are loaded and launched on the system, a Scheduled Task is used as a persistence mechanism to make the malware run every ninety minutes.

After the data is acquired, it is exfiltrated to a Telegram channel that the threat actor monitors. All of this data might end up in the hands of the highest bidder, or the malware might modularize and then be used as a dropper for additional malware or post-exploit tools, all the way up to ransomware.

Researchers have found striking similarities between the Phemedrone stealer malware and the Ov3r_Stealer malware.

Given the latest reports of this malware, it’s possible that Phemedrone was repurposed and given the new name Ov3r_Stealer. Phemedrone is written in C#, which is the primary distinction between the two.

The team discovered numerous aliases, communication channels, and repositories during their frantic search for information on the threat actors. Aliases like “Liu Kong,” “MR Meta,” “MeoBlackA,” and “John Macollan” were discovered in forums like “Pwn3rzs Chat,” “Golden Dragon Lounge,” “Data Pro,” and “KGB Forums,” where a regular gathering of “researchers,” threat actors, and inquisitive people takes place.


  • Engage Security Awareness Programs
  • Regular Application and Service audits and baselining
  • Application patching
  • Run continuous Threat Hunting through your environments for undetected compromises.

Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.


Latest articles

Ivanti EPM SQL Injection Flaw Let Attackers Execute Remote Code

In May 24, 2024, Zero-Day Initiative released a security advisory for Ivanti EPM which...

CISA Warns of Scammers Impersonating as CISA Employees

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about a surge...

Microsoft Windows Ntqueryinformationtoken Flaw Let Attackers Escalate Privileges

Microsoft has disclosed a critical vulnerability identified as CVE-2024-30088.With a CVSS score of 8.8, this flaw affects Microsoft...

256,000+ Publicly Exposed Windows Servers Vulnerable to MSMQ RCE Flaw

Cybersecurity watchdog Shadowserver has identified 256,000+ publicly exposed servers vulnerable to a critical Remote...

Indian National Jailed For Hacked Servers Of Company That Fired Him

An Indian national was sentenced to two years and eight months in jail for...

JetBrains Warns of GitHub Plugin that Exposes Access Tokens

A critical vulnerability (CVE-2024-37051) in the JetBrains GitHub plugin for IntelliJ-based IDEs (2023.1 and...

Critical Flaw In Apple Ecosystems Let Attackers Gain Unauthorized Access

Hackers go for Apple due to its massive user base along with rich customers,...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles