A new social engineering campaign tracked as “FakeSG” is distributing the NetSupport remote access Trojan (RAT) via phony browser updates, according to researchers at Malwarebytes. The campaign is similar but distinct from the widespread “SocGholish” campaign, which also uses fake browser updates to deliver NetSupport.
“[T]here is a potential new competitor in the ‘fake updates’ landscape that looks strangely familiar,” the researchers write. “The new campaign, which we call FakeSG, also relies on hacked WordPress websites to display a custom landing page mimicking the victim's browser. The threat actors are distributing NetSupport RAT either as a zipped download or via an Internet shortcut. While FakeSG appears to be a newcomer, it uses different layers of obfuscation and delivery techniques that make it a threat to take seriously and which could potentially rival with SocGholish.”
The NetSupport RAT is frequently used to steal information for use in additional attack campaigns.
“Fake browser updates are a very common decoy used by malware authors,” Malwarebytes says. “In addition to SocGholish, the Domen toolkit was a well-built framework that emerged in 2019 while another campaign known as sczriptzzbn dropped SolarMarker leading to the NetSupport RAT in both cases. Initial access brokers use tools like NetSupport RAT to gather information and perform additional actions on victims of interest. Stolen credentials can be resold to other threat actors tied to ransomware gangs.”
The researchers note that vulnerable WordPress sites are often exploited by multiple threat actors at the same time.
“It is interesting to see another contender in this relatively small space,” the researchers write. “While there is a very large number of vulnerable websites, we already see some that have been injected with multiple different malicious code. From a visitor's point of view, this means there could be more than one redirect but the ‘winner’ will be the one who is able to execute their malicious JavaScript code first.”
New-school security awareness training can give your employees a healthy sense of suspicion so they can avoid falling for social engineering attacks.
