Recent reports indicate that threat actors have been manipulating Script kiddies or amateur hackers into performing malicious actions that they never intended. This is done with the OpenBullet tool, which is used by web application testers and security professionals.

OpenBullet is an open-source security testing tool that can be used for conducting simple repetitive tasks as well as complex attacks with the help of a configuration file.

These configuration files are designed by sophisticated hackers and traded, shared, or even sold to cybercriminals.

However, these configuration files can be a single line or even hundreds of lines of code. Highly complicated codes are hard for initial-level hackers to read and understand.

Such a configuration file was found on a Telegram channel which seemed to have been maliciously coded for credential stuffing and account takeover attacks.

Weaponized OpenBullet Pentesting Tool

Further analyzing the configuration file, it was revealed that the code was designed to bypass Google’s reCAPTCHA and had multiple functions inside it along with a COOKIE variable.

It was found that the configuration file does more than just bypass the CAPTCHA.

The function written on the configuration file concatenates the COOKIE variable, which forms a Pastebin URL that redirects to a GitHub URL that consists of a repository called GetChromeUpdates.

OpenBullet retrieves the binary hosted on this repository which was found in a chromedriver.exe file.

This chromedriver.exe file replaces the SeleniumWebDriver used in OpenBullet. Once it is done, OpenBullet creates a new session that downloads two payloads from the same GitHub repository as Ocean and Patent.

Ocean is the downloaded script while Patent is a Python-based executable that does not have any obfuscation during compiling and was written in Python version 3.11.

Furthermore, the scripts download malware from the repository called Telegram-RAT, which contains the malware written in Python. It communicates with the command and control server using telebot.

A complete report has been published by the Kasada Threat Intelligence team which provides complete information on the methods, mechanisms, and code used by the threat actors.

Keep informed about the latest Cyber Security News by following us on GoogleNews, Linkedin, Twitter, and Facebook.