Tuesday, February 27, 2024

Beware of Facebook Ads That Deliver Password-Stealing Malware

A new malware called Ov3r_Stealer was found to be intended for stealing cryptocurrency wallets and passwords and then sending them to a Telegram channel that the threat actor maintains.

Identified early in December, the malware was spread via a Facebook advertisement for an account manager position. 

The user was directed via weaponized links to a malicious Discord content delivery URL, which triggered the attack’s execution phase.

“The malware is designed to exfiltrate specific types of data such as GeoLocation (based on IP), hardware info, passwords, cookies, credit card information, auto-fills, browser extensions, crypto wallets, Office documents, and antivirus product information,” SpiderLabs shared with Cyber Security News.

Run Free ThreatScan on Your Mailbox

AI-Powered Protection for Business Email Security

Trustifi’s Advanced threat protection prevents the widest spectrum of sophisticated attacks before they reach a user’s mailbox. Try Trustifi Free Threat Scan with Sophisticated AI-Powered Email Protection .

Facebook Ads Delivering Password Stealing Malware

A weaponized PDF file is used for the malware’s first access and transmission. The file impersonates a shared file on OneDrive. A simple clickable OneDrive link was found on a fake Facebook profile purporting to be Amazon CEO Andy Jassy. 

Another instance was seen applying for a Digital Advertising position through a Facebook advertisement.

 Facebook ad for a job in Digital Advertising

Upon selecting the “Access Document” link on the Facebook page, a file ending in .url is downloaded to initiate the subsequent phase. 

SpiderLabs at Trustwave found a quicker way to reach the [.url] in the job notification for “pink women’s magazine” on Facebook by utilizing the PDF file’s information.

The malware was downloaded in three files from a GitHub site utilizing a Powershell script that was run in the victim’s environment and pretended to be Windows Control Panel binary. 

Researchers observed additional ways to install the malware onto the system throughout the malware family study. These methods included HTML smuggling, SVG smuggling, and LNK file masquerading.

After the malware’s three files are loaded and launched on the system, a Scheduled Task is used as a persistence mechanism to make the malware run every ninety minutes.

After the data is acquired, it is exfiltrated to a Telegram channel that the threat actor monitors. All of this data might end up in the hands of the highest bidder, or the malware might modularize and then be used as a dropper for additional malware or post-exploit tools, all the way up to ransomware.

Researchers have found striking similarities between the Phemedrone stealer malware and the Ov3r_Stealer malware.

Given the latest reports of this malware, it’s possible that Phemedrone was repurposed and given the new name Ov3r_Stealer. Phemedrone is written in C#, which is the primary distinction between the two.

The team discovered numerous aliases, communication channels, and repositories during their frantic search for information on the threat actors. Aliases like “Liu Kong,” “MR Meta,” “MeoBlackA,” and “John Macollan” were discovered in forums like “Pwn3rzs Chat,” “Golden Dragon Lounge,” “Data Pro,” and “KGB Forums,” where a regular gathering of “researchers,” threat actors, and inquisitive people takes place.


  • Engage Security Awareness Programs
  • Regular Application and Service audits and baselining
  • Application patching
  • Run continuous Threat Hunting through your environments for undetected compromises.

Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.


Latest articles

14-Year-Old CMS Editor Flaw Exploited to Hack Govt & Edu Sites

Hackers have exploited a vulnerability in a 14-year-old Content Management System (CMS) editor, FCKeditor,...

Zyxel Firewall Flaw Let Attackers Execute Remote Code

Four new vulnerabilities have been discovered in some of the Zyxel Firewall and access...

Hackers Abuse Telegram API To Exfiltrate User Information

Attackers have been using keywords like "remittance" and "receipts" to spread phishing scripts using...

ThreatHunter.ai Stops Hundreds of Attacks in 48 Hours: Fighting Ransomware and Nation-State Cyber Threats

The current large surge in cyber threats has left many organizations grappling for security...

WordPress Plugin Flaw Exposes 200,000+ Websites for Hacking

A critical security flaw has been identified in the Ultimate Member plugin for WordPress,...

Hackers Actively Hijacking ConnectWise ScreenConnect server

ConnectWise, a prominent software company, issued an urgent security bulletin on February 19, 2024,...

Heavily Obfuscated PIKABOT Evades EDR Protection

PIKABOT is a polymorphic malware that constantly modifies its code, making it hard to...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Live Account Takeover Attack Simulation

Live Account Take Over Attack

Live Webinar on How do hackers bypass 2FA ,Detecting ATO attacks, A demo of credential stuffing, brute force and session jacking-based ATO attacks, Identifying attacks with behaviour-based analysis and Building custom protection for applications and APIs.

Related Articles