Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Check Point Research uncovered a malware campaign exploiting expired Discord invite links to redirect users to malicious servers. The attackers use a combination of techniques including ClickFix phishing, multi-stage loaders, and time-based evasions to deliver AsyncRAT and a customized Skuld Stealer targeting crypto wallets. The campaign leverages trusted cloud services for payload delivery and data exfiltration to avoid detection. The operation continues to evolve, with threat actors now able to bypass Chrome's App Bound Encryption using adapted tools like ChromeKatz to steal cookies from new Chromium browser versions. The campaign highlights how subtle features in Discord's invite system can be exploited as attack vectors.

The threat campaign titled "From Trust to Threat: Hijacked Discord Invites Used for Multi-Stage Malware Delivery" involves a sophisticated multi-stage malware distribution operation exploiting expired Discord invite links. Attackers hijack these expired invites to redirect users to malicious servers, leveraging the inherent trust users place in Discord invite links. The campaign employs ClickFix phishing techniques to lure victims into interacting with malicious content. It uses multi-stage loaders and time-based evasion tactics to avoid detection by security solutions. The primary payloads delivered are AsyncRAT, a remote access trojan capable of extensive system control, and a customized variant of the Skuld Stealer malware specifically targeting cryptocurrency wallets, aiming to exfiltrate sensitive financial data. The attackers utilize trusted cloud services for both payload delivery and data exfiltration, which helps them blend their malicious traffic with legitimate network activity, further complicating detection efforts. Notably, the campaign has evolved to bypass Chrome's App Bound Encryption, a security feature designed to protect browser cookies, by using an adapted tool named ChromeKatz. This capability allows the threat actors to steal cookies from the latest Chromium-based browsers, potentially enabling session hijacking and unauthorized access to web accounts. The exploitation of subtle features in Discord's invite system as an attack vector highlights the innovative approach of the adversaries. Indicators of compromise include multiple malware hashes, IP addresses, and domains such as captchaguard.me and microads.top, which are involved in the campaign's infrastructure. The campaign is ongoing and continues to adapt, underscoring the persistent threat it poses to users relying on Discord and Chromium browsers.

Detailed information about From Trust to Threat: Hijacked Discord Invites Used for Multi-Stage Malware Delivery. Get real-time updates, technical details, and m

From Trust to Threat: Hijacked Discord Invites Used for Multi-Stage Malware Delivery - Live Threat Intelligence - Threat Radar | OffSeq.com

From Trust to Threat: Hijacked Discord Invites Used for Multi-Stage Malware Delivery

A novel infostealer named Chihuahua Stealer has been detected, blending standard malware techniques with advanced features. This .NET-based malware employs a multi-stage PowerShell script infection process, utilizing Base64 encoding, hex-string obfuscation, and scheduled tasks for persistence. It targets browser data and cryptocurrency wallet extensions, extracting credentials, cookies, autofill data, browsing history, and payment information. The stolen data is compressed, encrypted using AES-GCM, and exfiltrated to an external server. The malware's sophisticated execution chain includes stealthy loading and a multi-staged payload, making it challenging to detect and analyze.

Chihuahua Stealer is a recently identified .NET-based infostealer malware that targets sensitive user data primarily from web browsers and cryptocurrency wallet extensions. It employs a sophisticated multi-stage infection process initiated via PowerShell scripts. These scripts are heavily obfuscated using Base64 encoding and hex-string transformations, complicating detection and analysis efforts. Persistence is maintained through scheduled tasks, allowing the malware to survive system reboots and maintain long-term access. Once active, Chihuahua Stealer extracts a wide range of browser data including credentials, cookies, autofill information, browsing history, and payment details. Additionally, it specifically targets cryptocurrency wallet extensions to steal wallet credentials and potentially gain access to digital assets. The stolen data is compressed and encrypted using AES-GCM, a modern authenticated encryption standard, before being exfiltrated to an external command and control server hosted at the domain flowers.hold-me-finger.xyz. The malware’s execution chain is designed for stealth, employing multi-stage payload delivery and obfuscation to evade traditional signature-based detection and complicate forensic analysis. Although no known exploits are currently reported in the wild, the medium severity rating reflects the potential impact of data theft, especially given the targeting of crypto wallets which can lead to irreversible financial losses. The use of PowerShell and scheduled tasks indicates that the malware leverages legitimate system tools, increasing its chances of bypassing endpoint security solutions that do not monitor script-based attacks effectively.

Detailed information about New 'Chihuahua Stealer' Targets Browser Data and Crypto Wallets. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'crypto wallets'

Filter Threats

Threats Tagged 'crypto wallets'