Wednesday, April 23, 2025
HomeMalwareHackers Attack AnyDesk Using Malvertising Campaign With Evasion Technique

Hackers Attack AnyDesk Using Malvertising Campaign With Evasion Technique

Published on

SIEM as a Service

Follow Us on Google News

AnyDesk is one of the famous remote desktop applications, and recently, the CrowdStrike cybersecurity researchers have detected that a whole malware network is continuously attacking AnyDesk. 

As per the experts, this malware is dealing with the delivery of an armed installation of a very famous software utility.  

The most interesting fact of this malware is that they are using fraudulent Google ads that are penetrating the search network results pages so that the hackers can easily reach the unsuspecting users.

- Advertisement - Google News

Initial Detection

According to the cybersecurity analysts of CrowdStrike report, the initial detection of this malware is that it is using the MITRE’s method T1036 to masquerade (Evasion technique).

Apart from this, the malware got an executable file that is resembling to have been influenced to avoid any kind of detection. Not only this but it is also trying to launch very strong PowerShell scripts that have the command line:-

“C:\Intel\rexc.exe” -exec bypass \Intel\g.ps1

However, in an investigation, the experts have detected a file “rexc.exe” that seems to be a renamed PowerShell binary, and here the main motive of this file is to bypass and avoid detections that are occurring.

Malvertisers developed the Legit AnyDesk app

After going through this malware, the experts came to know that the malicious campaign is dispatching all the assembled AnyDeskSetup.exe files which took off on April 21. 

When these files were being executed, the experts noticed that they are downloading a PowerShell implant, that is continuously exfiltrating all the data and information from the affected system.

Malvertising Campaign

The people who are searching AnyDesk on Google were being served by the malicious Google ads which have been placed by the threat actors, and this is happening from April 21, 2021.

However, this malicious campaign is using intermediary sites, which can later be redirected to a social engineering page at a specific URL that is https://anydesk.s3-us-west-1.amazonaws[.]com/AnydeskSetup.exe, and all the pages that are hosted in this URL is a clone of the legal AnyDesk website.

Intermediary websites used

The intermediary websites used by the threat actors are mentioned below:-

  • turismoelsalto[.]cl
  • rockministry[.]org
  • curaduria3[.]com

After the investigation, the security researchers have come to know that the threat actors are spending $1.75 per click. However, the experts stated that this method will not help the threat actors to get a shell on the targeted attack that they want.

But the usage of malicious Google ads is a quite effective method to get a strong way to dress mass deployment of shells. That’s why the analysts affirmed that AnyDesk is quite a common target for the threat actors, so, users must stay aware of these attacks.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Hackers Exploit Cloudflare Tunnel Infrastructure to Deploy Multiple Remote Access Trojans

The Sekoia TDR (Threat Detection & Research) team has reported on a sophisticated network...

Threat Actors Leverage npm and PyPI with Impersonated Dev Tools for Credential Theft

The Socket Threat Research Team has unearthed a trio of malicious packages, two hosted...

Hackers Exploit Legitimate Microsoft Utility to Deliver Malicious DLL Payload

Hackers are now exploiting a legitimate Microsoft utility, mavinject.exe, to inject malicious DLLs into...

Cybercriminals Exploit Network Edge Devices to Infiltrate SMBs

Small and midsized businesses (SMBs) continue to be prime targets for cybercriminals, with network...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Latest Lumma InfoStealer Variant Found Using Code Flow Obfuscation

Researchers have uncovered a sophisticated new variant of the notorious Lumma InfoStealer malware, employing...

North Korean IT Workers Use Real-Time Deepfakes to Infiltrate Organizations Through Remote Jobs

A division of Palo Alto Networks, have revealed a sophisticated scheme by North Korean...

Hackers Claim to Sell ‘Baldwin Killer’ Malware That Evades AV and EDR

A notorious threat actor has allegedly begun selling “Baldwin Killer,” a sophisticated malware toolkit...