Google Ads Used to Push Fake Google Chrome Installer

google ads, Google Chrome, malware, Ophtek, SecTopRat, security software, security_updates, , , , , ,
25
Mar 2025

Cybercriminals are exploiting Google Ads to distribute malware disguised as a genuine Google Chrome installer, tricking users into downloading the malware.

Threat actors are always innovative, and this recent attack underlines exactly why you need to be on your guard when online. Attackers have been purchasing ads which appear when PC users search for popular software downloads e.g. Google Chrome. Unfortunately, the ads which are served up lead to dangerous websites which closely resemble official download pages. This deception tricks users into downloading and installing malware.

As we spend a high proportion of our work time online, we’re going to dig deep into this attack to see what we can learn.

How Can Google Ads Compromise Your PC?

In this attack, users searching with terms such as “download Google Chrome” might find themselves confronted with a sponsored ad at the top of their search results. This ad can, at first, appear genuine, often having a URL which includes “sites.google.com” – a Google platform used to build free websites. Accordingly, users feel confident that these pages are official and trustworthy, especially when they look very similar to official download sites.

Once a user clicks the ad, they’re redirected to a malicious page which is a highly convincing imitation of the official Google Chrome download site. This page urges users to download a file named “GoogleChrome.exe” and, so far, everything appears as you would expect. With nothing unusual to suspect, users make the decision to trust the page, download the file, and then launch it.

However, once executed, the installer begins to act suspiciously. Firstly, it connects to a remote server to retrieve additional instructions. Secondly, it requests that they user grants it administrative privileges to assist in completing the download. At this point, alarm bells should start ringing, but most users still feel as though the software can be trusted. Once administrative privileges are granted, the installer executes a PowerShell command which prevents Windows Defender from scanning the malware’s location, enabling it to operate quietly in the background.

A further file is then downloaded to the BackupWin directory and, masquerading under the name of a genuine piece of software, opens up a communication channel with the threat actors’ remote server. The malware used is SecTopRAT, a Remote Access Trojan which allows the attackers to take remote control of the infected system and steal sensitive data such as capturing keystrokes, accessing files, and recording user activities.

Protecting Against the SecTopRAT Threat

Your employees are busy with their daily tasks and, therefore, it’s easy for them to have a lapse of judgement and quickly click on something they believe to be genuine. However, this can be disastrous for your IT infrastructure, so it’s crucial that your staff are mindful of the following:

  • Be Cautious of Sponsored Ads: Just because an ad is that the top of the search results, this doesn’t mean it can be trusted. This is why it’s important to always verify the authenticity of a URL before clicking it. Check for any unusual spellings or, to be fully safe, navigate directly to the official website for that software.
  • Only Download from Official Sources: The best approach is to always head straight to the developers website rather than trusting other online sources. Aside from sponsored ads, it’s critical that your team avoids downloading via links in emails or through torrent sites – both of these sources often lead to nothing but malware.
  • Keep Your Security Software Updates: One of the simplest ways to thwart attackers is to make sure your security software is up to date. This software regularly scans your system for threats, but it needs to be updated as soon as possible to detect the latest threats.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

Malicious Code Found Embedded in Steam Downloads

anti-malware_software, malware, Ophtek, PirateFi, security, Steam, vidar, , , , ,
18
Mar 2025

A malicious game on Steam called PirateFi was found to contain malware which steals personal information, highlighting the risks of unverified downloads.

A recent attack involving a game on Steam has highlighted the importance of vigilance when downloading software. The game, called PirateFi, was available to download on Steam – an online platform for buying and playing games – but contained malware designed to steal personal data from players’ computers.

Pirates Strike Gold on Infected Systems

PirateFi – which was a free to play game – was developed by Seaworth Interactive and available on Steam from February 6th to February 12th, 2025. Promising an engaging and challenging survival experience, setting players objectives such as base building, food gathering, and making weapons, PirateFi was downloaded by around 1500 players and generated numerous positive reviews.

However, it was soon discovered that PirateFi was not simply a game meant to excite players and take their minds off the real world. Reports soon emerged that the game contained malware known as Vidar, a data-stealing program. Vidar is designed to harvest sensitive data from infected computers, so this could easily include passwords, financial information, and personal documents. Rather than Vidar being bundled with PirateFi as bloatware, Vidar was embedded within the game’s files, allowing it to be launched when the game was started.

Valve, the company behind Steam, quickly removed PirateFi from their platform on February 12th, when the threat was identified. They were also swift in issuing security notifications to those who had downloaded the game. Valve’s advice was, for those who had downloaded PirateFi, to run a full system scan using up-to-date antimalware software to detect and remove any dangerous files. Alternatively, Valve suggested that those at risk fully reinstalled their operation system to ensure Vidar was completely removed.

Staying Safe from Dangerous Downloads

This attack underlines the ingenuity and evolving tactics of threat actors, who are increasingly targeting popular platforms like Steam and GitHub to distribute their malware.

By disguising their malware as legitimate tools on these platforms, the threat actors are exploiting the trust users place in these websites. For a threat actor, this is fantastic as it opens up their attack to a huge audience. However, for a user it’s highly frustrating and dangerous. Accordingly, you need to practice the following to remain safe:

  • Be Cautious with Unverified Software: Before downloading and installing new software, especially from lesser-known sources, always take the time to research the application. Seek out reviews from reputable sources and check for any reports of malicious activity relating to the software.
  • Keep Your Security Software Updated: Ensure that your antivirus and anti-malware programs are always up to date. Regularly scan your system for potential threats, particularly after installing new applications. Updated security software can detect, quarantine and delete the latest malware threats before they can take hold of your system.
  • Monitor for Unusual Activity: Always be mindful of any suspicious activity on your networks, such as unusual drops in performance, unfamiliar programs executing, or unauthorized access to your accounts. If you notice signs such as these, there’s a chance that your network has been breached.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

Malicious Chrome Extensions Threaten Millions

Bard AI Chat, ChatGPT, Cyber Attack, Facebook Ads, Google Chrome, Google Meet, malware, Ophtek, Phishing, , , , , , ,
04
Feb 2025

A recent cyberattack has compromised several popular Google Chrome extensions, infecting millions of users with data-stealing malware.

In early January 2025, cybersecurity researchers at Extension Total discovered a malicious campaign targeting Chrome extensions which offer AI services. The threat actors hijacked at least 36 extensions – including Bard AI Chat, ChatGPT for Google Meet, and ChatGPT App – with approximately 2.6 million users affected. This widespread attack has raised the alarm among users and software developers as, previously, these extensions were highly trusted.

With 3.45 billion people using Chrome as their browser, it’s no surprise that threat actors would target it. This attack is especially ingenious, so we’re going to take a deep dive into it.

How Were the Chrome Extensions Compromised?

The affected extensions may be named after popular AI tools like Bard and ChatGPT, but they are third-party applications with no development from Google or OpenAI. Third-party extensions can, of course, be legitimate, but these compromised extensions were far from helpful. Instead, they were used to deliver fake updates containing malware.

The malware was designed to steal sensitive user information, specifically targeting data related to Facebook Ads accounts. Therefore, this posed a significant threat to businesses which rely on Facebook for marketing and sales. With this stolen data, the threat actors could use it for unauthorized access, financial and identity theft, or to fuel phishing attacks.

In response to the attack, many of the affected extensions have been removed from the Chrome Store to limit further infections. However, others remain available, exposing users to the malware. Chrome, as we’ve already mentioned, is hugely popular with around 130,000 extensions are available to install. The risk of a security incident, as you would imagine, is high; this recent attack underscores the importance of practicing vigilance when installing extensions.

Staying Safe from Rogue Chrome Extensions

Browser extensions are designed to help users by enhancing functionality and making everyday browsing easier. However, this recent attack has also demonstrated that they’re a security risk. Ophtek wants to keep you safe from similar attacks, so we’ve put together our top tips for protecting your PC from rogue extensions:

  • Install Extensions from Trusted Sources: you should only ever download extensions from reputable developers and official web stores. Before hitting that install button, always carry out some research on the developer, read user reviews, and check ratings to assess how legitimate it is.
  • Limit Extension Permissions: extensions often require permissions to function correctly on your PC but be very careful of any extension which requests a long list of permissions e.g. access to browsing data, microphone control, and cookies. You should only ever grant permissions to what is necessary for the extension to operate. If in doubt of a permission request, seek help from an IT professional.
  • Update Extensions: always ensure your extensions are kept up to date, as developers often release patches to fix security vulnerabilities. Regularly check for updates and keep an eye out for any unusual browser behavior such as strange pop-ups, redirects to other sites, or performance issues. Additionally, if you have extensions you no longer use, remove these to reduce your exposure to risk

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

Microsoft Defender Caught Out by Fake Gaming Malware

cryptocurrency, cryptojacking, data harvest, Defender, malware, Malwarebytes, Ophtek, Orbit Unit, , , , , , ,
17
Dec 2024

Microsoft Defender is an app whose objective is to defend against malware, but what happens when malware outsmarts it?

We’ve all heard the headlines about the volatile world of NFTs, but a new development is that they’re being used to help spread malware. In a particularly extreme case, one PC user thought they were downloading an NFT game, but the only thing which got played was the victim’s Google account. As a result of the Google account being hijacked, the victim ended up losing over $24,000 in cryptocurrency.

This incident, as with many other scams, relied on a momentary lapse of judgement, so we’re going to put it under the spotlight to see what we can learn.

How Did an NFT Game Carry Out a Robbery?

The attack started when the victim received a message from a stranger over Telegram, an encrypted messaging service which prides itself on the anonymity it provides users. The message urged the victim to download a blockchain game called Orbit Unit. Deciding that the message was harmless and the recommendation worthy of investigation, the victim downloaded Orbit Unit and installed it.

Unfortunately, the download was fake and riddled with malware. Once activated, the malware went on to install a malicious Chrome extension. Housed within the Chrome browser, the extension was titled Google Keep Chrome Extension, in an attempt to mimic the genuine Google note keeping app. The malicious app certainly fulfilled its promise of taking notes but did so in a way which compromised the victim’s data. All data entered into Chrome, be it login credentials, cookies, or browser history, was harvested by the malware.

For the victim, it was particularly frustrating as they had Malwarebytes on their PC and it failed to detect the malware. This has been attributed to the victim most likely having the free version of Malwarebytes, where real-time protection isn’t activated. What they did have, though, was Microsoft Defender, an app which promises to help “individuals and families protect their personal data and devices.” In this instance, Microsoft Defender failed spectacularly.

The threat actor behind the malware was able to access the victims Google passwords through Chrome and gain access to their cryptocurrency wallets. It was from here that they were able to steal $24,000 worth of cryptocurrency.

Staying Safe When Malware Protection Fails

You and your employees may not deal in cryptocurrency, but this cyberattack demonstrates the importance of being able to identify a potential attack and protect your data. Therefore, make sure you practice these best security practices:

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

Infostealers: What They Are and How to Stay Protected

Infostealers, malicious sites, malware, Ophtek, Phishing Email, SambaSpy, security software, SnipBot, software updates, , , , , , , ,
03
Dec 2024

Infostealer malware is frequently referenced as the go-to weapon for threat actors, but what is it? And how do you protect your IT systems from it?

You only have to take a quick look over the Ophtek blog to understand the popularity of infostealers in modern hacking. From fake Zoom sites through to SnipBot and SambaSpy, threat actors are determined to get their hands on your sensitive data. Infostealers, therefore, present an everyday threat to PC users and it’s crucial you understand their methods and impact.

Luckily, Ophtek has your back, and we’re going to take a deep dive into infostealers to equip you with the knowledge you need to stay safe.

What is an Infostealer?

The main objective of all infostealer malware is to harvest confidential data from a compromised system. With this stolen data, threat actors have the opportunity to conduct numerous crimes such as identity theft or financial damage. This makes infostealer malware such a serious threat, especially in the age of big data, where organizations hold huge amounts of data on their IT systems. As with most modern malware, infostealer has strong stealth capabilities, allowing it to operate in the background without being detected and strengthening its impact.

The Danger Behind Infostealers

Infostealers can be individual malware threats or part of a more extensive suite of malware applications. Whatever their method, infostealers tend to focus on stealing the following data:

  • System login credentials
  • Social media and email passwords
  • Bank details
  • Personal details

All of these data categories have the potential for serious damage e.g. hacking someone’s personal emails and reading confidential information or clearing someone’s bank account out. From a business perspective, infostealers also have the potential to gain access to secure areas of your IT infrastructure and compromise the operations of your business. All of this data is taken directly from your servers and then discreetly transmitted to a remote server set up by the threat actors.

How Do Infostealers Strike?

Threat actors have developed numerous strategies to launch successful infostealer attacks with the two most common methods being:

Protecting Your Systems Against Infostealers

Despite the threat of infostealers, it’s relatively easy to stay safe and protect your systems from them. All you need to do is follow these best practices:

  • Be Wary of Suspicious Emails: Any emails which ring even the slightest alarm bell should be closely scrutinized. If something about the wording doesn’t sound quite right, or there’s a sense of urgency to commit to an action, the chances are that this could be a phishing email. In these instances, don’t click anything and, instead, contact an IT professional to review the content.
  • Always Update Your Software: One of the easiest ways for threat actors to deploy infostealers on your system is through software vulnerabilities. No piece of software is perfect, and they often contain weak spots which can be exploited. However, as these vulnerabilities are picked up by the developers, security patches are issued to remedy these weak spots. Accordingly, installing these updates should be a major priority.
  • Install Security Software: There are numerous security packages available such as AVG and Kaspersky which monitor your systems in real time and can block malware threats instantly. This automatic defense enables you to stay safe from infostealers and keeps your networks healthy and productive.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More
1 2 3 … 21