Hackers hijacked the official website of the popular video editing software and replaced the download links, causing the users to download the banking malware.
VSDC is the popular video editing software and the company official website has nearly 1.3 million monthly visits.
Hackers hijacked the download links that causing visitors to download the dangerous banking malware, Win32.Bolik.2, and the Trojan.PWS.Stealer (KPOT stealer) along with the editing software.
According to Doctor Web researchers, one of the VSDC developer’s computer has been compromised, which led to the website hijack. The website found to be compromised between 2019-02-21 and 2019-03-23.
So users who download the VSDC software from the website will also receive a dangerous banking malware Win32.Bolik.2, which is the predecessor of Win32.Bolik.1. As of now, 565 users have been infected with malware.
The malware is designed to perform the following functions
- Web injections
- Traffic intercepts
- Stealing banking credentials
“Additionally, on 22.03.2019 the attackers changed the Win32.Bolik.2 trojan to another malware, a variation of the Trojan.PWS.Stealer, KPOT Stealer. This trojan steals information from browsers, Microsoft accounts, several messengers and some other programs. In just one day it was downloaded by 83 users,” reads Dr.web blog post.
Last year also the companies official website has been compromised and replaced with download links that download AZORult Stealer, X-Key Keylogger and the DarkVNC backdoor.
Doctor Web notified to VSDC and the download links are restored now if you downloaded the software in the period, then you will be affected. Users are recommended to install antivirus Anti-Virus/Malware Software and check their devices for infection.
Indicators of compromise IoCs