New malware
Source Reddit Malware
Discussion
A new malware masquerading as ClearMic, a legitimate microphone noise suppression application, has been identified. This malicious software is a Remote Access Trojan (RAT) that logs keystrokes, captures screens, hijacks clipboard data, records microphone audio, and exfiltrates this information to a remote server. It also deletes Windows Shadow Copies to hinder file recovery, a behavior typical of ransomware. The malware detects sandbox environments to evade analysis. Users who have installed this malware are advised to disconnect from the internet, run anti-malware tools, and change passwords from a clean device.
r/Malware (opens in a new tab)u/Emotional-Carob-7500 points0 comments
clearmic.net is malware, do not download it
Someone sent me this site asking if it was legitimate. I ran the installer in a sandbox and it's a RAT.
It looks like a mic clarity app but bundles a hidden second executable that runs in the background. Here's what it actually does: logs your keystrokes, captures your screen, hijacks your clipboard, records microphone audio, and sends everything out to a remote server encrypted. It also deletes Windows Shadow Copies which is standard ransomware behaviour to stop you recovering your files.
It actively checks if it's running in a sandbox too, which is why I'm glad I tested it before running it on a real machine.
Full sandbox analysis if you want to dig into it yourself: https://tria.ge/260621-vsjxnaet4k/behavioral2
If you already ran this, disconnect from the internet and run Malwarebytes immediately. Change your passwords from a different device, especially Discord, email, and anything with saved credentials in your browser.
Spread this around so people don't get caught out.