Malicious Popup Exploits WordPress Site to Deliver Trojan

EXECUTIVE SUMMARY

A recent investigation into a compromised website used to distribute a sophisticated malware campaign. The infection started with an alarming message presented to unsuspecting visitors through a fake browser popup. The popup, mimicking a legitimate "Aw, Snap!" error message, tricked users into believing their browser was malfunctioning and offered a deceptive solution: installing a root certificate by following a set of suspicious instructions. The scam targeted users unfamiliar with system-level commands and technical jargon, enticing them to run PowerShell commands under administrative privileges. The attackers relied on a fake sense of urgency and exploited the victim’s lack of technical knowledge to launch malware directly from the system’s shell. The aim was to plant trojan malware on the victim's system while hiding its tracks. Such scams prey on those unaware of basic security practices, and the post encourages heightened vigilance and the ability to recognize common warning signs of online threats.[emaillocker id="1283"]

The technical details of the malware operation reveal a carefully designed process that exploits Windows’ system components to silently deploy a trojan. Once the victim executes the PowerShell commands, the malware downloads an executable file, disguised through a shortened URL service (cutt.ly), which is then stored in a hidden directory within the victim's AppDataRoaming folder. The malware attempts to disable Windows Defender by using the Add-MpPreference command, adding itself to the exclusion list, thus avoiding detection and scans. Furthermore, the malware is configured to run at startup, ensuring persistence even after system reboots. A deeper investigation into the shortened URL revealed a payload that leads to a malware executable known as "zilla.exe" hosted on a GitHub repository associated with an account called Romebo, active for about half a year. Further analysis from security firm MalwareBytes linked this malware to the ClearFake campaign, notorious for delivering RedLine Stealer, a malicious payload that contacts external servers, potentially paving the way for ransomware infections orchestrated by threat actor TA571.

The attack illustrates a typical malware delivery mechanism that exploits both website vulnerabilities and users' lack of technical knowledge. By injecting a malicious popup into a compromised WordPress website, the attackers targeted unsuspecting visitors with a message translated into 42 languages, vastly broadening their potential victim pool. The pop-up’s ability to gather user information, including browser and language preferences, allowed the attackers to craft a convincing attack based on the victim’s locale. With connections to RedLine Stealer and a high risk of ransomware infections, this case underscores the importance of maintaining strong security practices. Website owners are advised to regularly back up their sites, update core software, use strong passwords, enable two-factor authentication, and monitor for suspicious activity. While users should be cautious when faced with unexpected system requests, website administrators play a critical role in safeguarding their platforms against being used as a vector for widespread malware distribution.

THREAT PROFILE:

REFERENCES:

The following reports contain further technical details:

https://blog.sucuri.net/2024/08/wordpress-websites-used-to-distribute-clearfake-trojan-malware.html