Attackers appear to have implemented a filtering mechanism in order to avoid detection, with researchers postulating that the attackers may be able to distinguish between real users and scanners or researchers attempting to investigate the campaign.
Researchers have noted that what makes the campaign particularly noteworthy is the way it leverages the user’s browser to facilitate the generation of malware on the victim’s machine.
In contrast to traditional malvertising attacks, in which exploit kits are used to deliver payloads, this campaign appears to make use of Service Workers and Shared Workers in order to construct the malware.
Initially, the target is directed to a fraudulent website, which proceeds to register a Service Worker that will be responsible for facilitating the download of the malware. A Shared Worker is then used for the assembly of the malware, which receives the necessary instructions and components via the Service Worker.
Notably, the website is reported to be requesting configuration data in order to construct files with varying hashes, which would allow the attackers to bypass security measures such as signature-based detection.
Instead of delivering an executable file, the site then responds with the data necessary for the browser to compile the file locally, with the components being downloaded and compiled in conjunction with remote resources in order to generate the final payload. It should be noted that the file reportedly makes use of a sanitized version of Bun executable.
It is reported that the generated file is then delivered back to the Service Worker and eventually downloaded by the browser as if it were a legitimate file, which would explain why the malware would not be detected by conventional security measures. In addition, researchers note that the file may be challenging to analyze, as the final payload would only be available once the browser constructs it.
Researchers note that the campaign, which goes by the name of SourTrade, previously made use of the StreamSaver project to deliver payloads, but has since switched to distributing malware via Service Workers.
Reporters have noted that the techniques made use of by the campaign are similar to those described in a previous Bitdefender report on malware that was able to hijack encrypted traffic and exfiltrate sensitive data such as cookies, passwords, cryptocurrency wallet credentials, record keystrokes, take screenshots and maintain persistence on the target machine.
Due to the fact that the campaign specifically targets cryptocurrency and trading platforms, it is possible that attackers will be able to leverage the stolen information to gain unauthorized access to the victim’s accounts.
As such, users are advised to avoid downloading any cryptocurrency or trading-related applications via social media or search engines, and to only download such applications directly on the company’s official website whenever possible.
