Cybercriminals have many options to sneak viruses and steal passwords or personal data. They could trick you into a phishing email, install a malicious program, or install a fake update. In this article, we cover how they are pushing malware payloads through websites. We are going to talk to you about what you should do to avoid problems and always be protected.
But what exactly do they do? What hackers are doing is sneaking encrypted payloads into content that, on paper, is legitimate. They are using platforms like GitHub. They hide them in user profiles on forums and news sites, as well as video descriptions on streaming platforms.
Malicious payload leaked
Hackers sneak malicious payloads without raising suspicion. They do this by using fake profile links on forums, video descriptions on certain platforms or news pages. This payload does not represent a direct threat to whoever visits that website, but rather occurs when downloading some content.
Furthermore, by using well-known pages, this can give a greater feeling of security. The victim does not believe that they are dealing with something malicious, just as antiviruses are not going to sound the alarm when they enter these websites.
This attack begins when the victim double-clicks a malicious LNK shortcut file. From there, it runs a PowerShell script explorer.ps1, which in turn downloads a payload that decodes a URL used to download and install the malware. These encrypted text files are posted on sites like GitHub and GitLab.
This attack, which uses the EMPTYSPACE malware, then downloads a backdoor as well as cryptocurrency miners that mine Monero, Ethereum, Dogecoin, and Bitcoin. It will also have the ability to infect USB drives and distribute malware, take screenshots or collect information of all kinds.
Protect yourself from these attacks
What can you do to protect yourself from attacks of this type? Without a doubt, the main thing is not to make mistakes. You should not download any files from links that you cannot trust 100%. Much less install any software. It could be a trap, malware that also spreads to your pendrive and another device.
Although in this case it is not about exploiting a vulnerability, there are other threats that take advantage of recognized flaws. Therefore, it is advisable to have the system updated at all times. This will help you avoid many cybersecurity problems and keep your computer as protected as possible.
On the other hand, it is advisable to always have a good antivirus. Using security software can save you from many problems. Of course, make sure that you are going to install one with guarantees. You should read comments and ratings from other users to use an option that really contributes positively.
In short, we are facing a new threat capable of sneaking malware into a pendrive or any drive you put on your computer. It is essential that you take measures and protect yourself correctly. You must protect the browser, your system or any program you use.
