Cybersecurity experts at Cyble Research and Intelligence Labs (CRIL) have recently identified a fake AnyDesk website (hxxp://anydesk[.]ml).
They found this website was spreading Mitsu Stealer, and it’s a sophisticated custom-made 64-bit malware. This malware is primarily designed to steal all sensitive information from unsuspecting victims.
One of the most surprising aspects of this malware is that it is constructed from code that is freely available on GitHub.
Currently, the website has not been involved in any malvertising campaigns. However, the mediums used by the operators of this fake website for promotional purposes are:-
According to the report, After clicking on the Downloads button on the phishing website the infection chain begins, and the user gets infected by the malware delivered by the phishing site. The Mitsu Stealer malware was downloaded from the remote server in the following form:-
It’s a 64-bit Windows executable file that is based on the Microsoft Visual C++/C++ GUI.
There is much similarity between the phishing site and Anydesk’s genuine website when it comes to its appearance. In short, the threat actors have designed the fake phishing website perfectly with all the elements that are present in the genuine website.
Here below we have mentioned other two key aspects that the threat actors have mimicked from the original one to make the fake website more authentic:-
The Mitsu Stealer was created using the Python programming language. The stealer performs the following illicit actions when it is executed:-
Upon installation of the malware, it will now create a list of the processes running on the computer system of the user. In order to determine the names of the processes associated with the network analysis tool, the program examines the names of the processes.
Now to replace the API/webhooks with MitsuTheGoat, the malware circumvents the BetterDiscord. Thereafter, from the infected system of the victim the stealer collects all the sensitive data like:-
The malware also targets cryptocurrency wallets and other wallets to steal financial information and abuse them for financial gains. For data extraction following SQL queries are used by the malware:-
Here below we have mentioned all the web browsers targeted by the stealer to steal user data:-
In order to collect Discord tokens, the malware reads and extracts the following files from a variety of locations across the system:-
The malware then creates a JSON dump that sends the stolen data to a Discord webhook. Afterward, the stealer downloads a JavaScript file called index.js in order to conduct the illicit activity that the threat actors want.
Here below we have mentioned all the recommendations:-
Also Read: Download Secure Web Filtering – Free E-book
Phishing attackers used Google Docs to deliver malicious links, bypassing security measures and redirecting victims…
The Python-based NodeStealer, a sophisticated info-stealer, has evolved to target new information and employ advanced…
A significant XSS vulnerability was recently uncovered in Microsoft’s Bing.com, potentially allowing attackers to execute…
Meta has announced the removal of over 2 million accounts connected to malicious activities, including…
Critical security vulnerability has been identified in Veritas Enterprise Vault, a widely-used archiving and content…
A critical security vulnerability has been disclosed in the popular file archiving tool 7-Zip, allowing…