Suspicious links Archives

CoffeeLoader Malware: Hiding in Your GPU

CoffeeLoader, malicious downloads, malware, Ophtek, PC Security, security practices, Suspicious links, UpdatesCofeeLoader, malware, Ophtek, security, updatesOphtek, LLC

May 2025

A new malware named CoffeeLoader exploits computer GPUs to escape security measures, posing a major threat to PC users.

Cybercriminals are constantly enhancing their tactics and looking for new strategies, and the latest threat is CoffeeLoader – a slice of malware which takes an innovative approach to hiding from security tools. Typically, malware runs on the central processing unit (CPU) of a PC, but CoffeeLoader throws a curveball by executing on the graphics processing unit (GPU). Most security software ignores GPU activity, so CoffeeLoader is able to operate silently in the background.

All malware is a nightmare, but malware which can only be described as ingenious is even worse. That’s why Ophtek’s going to give you a quick run through on what’s happened and how you can keep your PCs safe.

Brewing Trouble: The Tactics of CoffeeLoader

The exact mechanics of how CoffeeLoader infects a system has not, as of yet, been revealed. However, as with most malware, it’s likely that CoffeeLoader is used in conjunction with phishing emails and malicious websites. What is known about CoffeeLoader is its unique approach to protecting itself.

One of CoffeeLoader’s key tactics is to integrate ‘call stack spoofing’ into its attack. Security tools usually track how programs execute by monitoring their call stacks. But what, you may ask, is a call stack? Well, to keep it simple, we’ll describe it as a log of commands showing the program’s activity flow. However, this is where CoffeeLoader’s deceptive streak starts. By distorting its stack, it appears as though it’s running legitimate processes. This allows it to blend in with your usual system activity, avoiding detection with ease.

To strengthen its stealth credentials, CoffeeLoader also employs sleep obfuscation. This is a technique used by threat actors to evade detection by inserting artificial delays or sleep functions into its code. This allows the malware to appear inactive or dormant, a technique which enables it to escape detection by behavioral analysis tools.

Finally, CoffeeLoader exploits Windows fibers – these are lightweight execution threads commonly used by genuine, harmless applications. Manipulating these fibers allows the malware to switch execution paths mid-attack, which makes it more unpredictable and difficult for security programs to trace.

Combined, these three techniques underline the dangerous threat contained within CoffeeLoader. From running on a PC’s GPU and using multiple processes to conceal itself, CoffeeLoader can evade detection and exploit an infected system to its heart’s content.

How Can You Avoid Being Burnt by CoffeeLoader?

As cyber threats become more advanced through attacks such as CoffeeLoader, it’s crucial that PC users adopt these best practices to stay safe and protect their systems:

Keep Your Software Updated: one of the simplest ways to protect your IT infrastructure is by ensuring that your applications are kept up-to-date and secure. This can easily be achieved by always downloading the latest software patches and updates as soon as they’re available. Hackers thrive upon outdated software and the associated vulnerabilities, so it’s paramount that you prevent this.
Use Advanced Security Tools: Basic anti-malware software is fine for your average PC user, but businesses often need something a little more robust. Advanced security suites offer behavior-based detection that can analyze and recognize unusual activity.
Be Careful with Downloads and Links: The internet is full of dangers and hazards, so you should avoid downloading anything from untrusted websites or clicking on links in suspicious emails. The best way forwards with downloads and links is to only trust them if they’re from genuine, legitimate websites – this prevents you from downloading malware.

For more ways to secure and optimize your business technology, contact your local IT professionals.

A new malware attack has been discovered which uses the SnipBot malware to dig deep into the victim’s network and harvest data.

SnipBot is a variant of the RomCom malware, which has previously been used for data harvesting and financially motivated attacks such as the Cuba ransomware attack. SnipBot’s malicious campaign has been widespread, with victims identified in multiple industries including legal, agriculture, and IT sectors. SnipBot performs what is referred to as a pivot, a process by which malware moves between compromised systems on the same network to access as many workstations as possible. This maximizes the amount of data SnipBot can steal and marks it out as a major threat.

SnipBot Unleashed

With 3.4 billion phishing emails sent daily, it’s clear that phishing attacks are incredibly popular with threat actors. And this is the exact approach adopted by SnipBot.

The SnipBot malware attack starts with phishing emails which trick recipients into downloading fake files disguised as legitimate PDFs. When the victim clicks on a link contained within the PDF, a malicious downloader is activated. As these downloaders are signed using real security certificates, they avoid detection by security software.

The malware can then inject itself into core system processes such as explorer.exe, and it can maintain this presence even after a reboot. Once inside the victim’s system, SnipBot sets about collecting sensitive data from popular folders, like Documents and OneDrive. This harvested data is then sent back to the attacker via a remote server.

Palo Alto Networks researchers, who discovered the SnipBot campaign, are unsure as to the true objectives of SnipBot. At present, there appears to be no financial motive present in the attack, so it has been labelled purely as an espionage threat.

How Can You Stay Safe from SnipBot?

Luckily, phishing attacks such as SnipBot can be easily managed. By following these best practices, you’ll not only prevent malware being executed, but also avoid it in the first place:

Verify the Sender: it’s paramount that you always check and double check the sender’s email address, especially when the email is laced with a sense of urgency to perform an action. Phishing emails will often use addresses which look genuine but contain slight errors e.g. admin@0phtek.com where the letter O has been replaced with a zero. If you’re unsure, you can always Google the company to find their official website and verify the domain used.
Don’t Click on Suspicious Links: instead of clicking on suspicious links, the safest option to take is to hover over any links to preview the URL. Embedded links can easily be faked to appear genuine, but contain a link to a different, malicious website. Again, you can Google websites directly to navigate your way to any sections referenced in the email. This prevents you from accessing a malicious website loaded full of malware.
Contact the Sender: legitimate businesses and clients will never request sensitive information – such as login credentials – over emails, so these requests should always ring alarm bells. If you do receive such a request, the best option to take is contact the sender via telephone to confirm whether the email is genuine.
Use Spam Filters: one of the best ways to stop phishing emails reaching your inbox is to activate your emails spam filters. These use vast databases to identify potential threats and redirect them to your spam folder. You can also use your spam filters to block repeat offenders, enhancing the safety of your inbox.

For more ways to secure and optimize your business technology, contact your local IT profe ssionals.

A recently discovered vulnerability appears to allow threat actors to hack into your Google account, even if you change your password.

Given that there are 1.8 billion people actively using Gmail, it should come as no surprise that Google accounts represent a mouthwatering target for hackers. Google claims that their users are protected by world-class security and, on the whole, it is a secure system. No infrastructure, however, is 100% safe. Threat actors are industrious individuals and won’t rest until they’ve tried every avenue to compromise a system. Unfortunately, for Google and its users, this is exactly what’s happened.

Losing Control of Google

Google accounts are highly valuable to their owners. Packed full of apps such as Gmail and Google Drive, there’s a lot of personal data involved. A new vulnerability, attributed to a flaw in Google cookies, gives access to these accounts over to threat actors. Worst of all, this can be achieved time after time. Sure, you can try changing your password, but they will still be able to unlock your account.

The attack starts when a user unwittingly allows malware to be installed on their PC. This malware then gets to work by searching for and identifying any Google login tokens, which are typically stored in the application’s local database. These stolen tokens can then be used to trick Google’s API interface.

One of the main duties of a Google API is to help sync the various Google services across one account. So, for example, if you were logged into Google Drive, you wouldn’t have to log into Gmail as well. The threat actors exploit a vulnerability with Google cookies to create new cookies which can be used to gain unauthorized access to the compromised account. And this trick can be completed multiple times. Changing your password, naturally, would be the simple choice here. But even doing this still grants the hacker one more chance to access your account.

The vulnerability in question is currently being sold by threat actors online, with at least six hacking groups advertising it. These threat actors also claim that that this vulnerability has been redesigned to tackle the efforts Google has taken to shut this exploit down.

Keep Your Google Account Safe

No one wants to lose their Google account, aside from the loss of personal data, there’s also the sheer inconvenience of having to create a new account and updating any services associated with your original account. Accordingly, make sure you play safe by following these best practices:

Use multi-factor authentication: at present, Google hasn’t revealed whether multi-factor authentication will prevent this vulnerability from seizing control of your account. However, if you don’t have it activated, you need to make this a priority as it’s one of the simplest ways to add extra security to your account.

Do not download suspicious software: the first stepping stone for the threat actors to compromise your Google account involves installing malware on your PC. This gives them a foothold to begin stealing your Google login tokens. Therefore, you need to remain vigilant as to the software you’re downloading. The most obvious question to ask here is whether the download comes from an official source.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Facebook Ads Used to Deliver NodeStealer Malware

block social media, Facebook Ads, malware, NodeStealer, Ophtek, Phishing, Suspicious linksFacebook Ads, links, malware, NodeStealer, Ophtek, phishing, social mediaOphtek, LLC

Dec 2023

Threat actors have turned to Facebook ads to unleash NodeStealer on unsuspecting victims, and they’re using scantily clad women to achieve this.

Facebook is no stranger to finding its ad network compromised to spread malware, but what’s interesting about this latest campaign is that it primarily targets males. At the core of this attack is NodeStealer, a strain of malware which has been active for several months. However, NodeStealer has changed. At the start of its existence, it was designed in JavaScript, but it’s now being coded with the Python programming language.

NodeStealer is part of a wider campaign, believed to have its origins in Vietnam, to steal sensitive data, and it’s more than worthy of your attention.

How Does NodeStealer Target its Victims?

Using marketing strategies almost as old as time, the threat actors behind NodeStealer have used the provocative lure of female flesh to entice their victims. Taking advantage of the massive reach of Facebook’s ad network, these threat actors have created adverts which contain revealing photos of young women. The objective of these adverts is to encourage people to click on them, a process which will download an archive of malicious files.

One of these files is called Photo Album.exe but, far from containing any photos, it simply downloads a further executable file which unleashes NodeStealer. With NodeStealer running rampant on an infected system, it will begin harvesting login credentials and, in particular, it will attempt to take control of Facebook business accounts. With further business accounts compromised, NodeStealer can launch even more malicious ad campaigns and spread itself further.

Stay Safe from the Threat of NodeStealer

NodeStealer is a classic example of malware deceiving its victims to achieve its goal. And it’s not surprising to hear that the 18 – 65 male demographic have made up the majority of its victims. Regardless of the bait, however, NodeStealer provides us with a number of interesting lessons to learn. The most important takeaways should be:

Block social media sites: the NodeStealer campaign is the perfect example of why corporate networks should block social media sites. Yes, certain businesses will need to access these sites for marketing reasons, but general access should be shut down to employees.
Educate on phishing techniques: the threat actors behind NodeStealer have used typical phishing techniques to convince unsuspecting users that they should click on their ads. And this is where you need to educate your employees. Demonstrate how if it sounds too good to be true, then it almost always is. Make this not just part of your IT inductions, but also as regular refreshers to keep employees on their guard.
Always double check links: the malicious links contained in adverts will usually direct people to a different destination than promised. This means it’s crucial you understand the importance of checking links before clicking them. The simplest way to do this is by hovering your mouse cursor over links to reveal their true destination. And, always remember, if in doubt about a link (or advert), check with an IT expert before clicking it.

For more ways to secure and optimize your business technology, contact your local IT professionals.

What is Ransomware as a Service?

Ophtek, Phishing, Ransomware, Security, Suspicious links, UpdatesOphtek, phishing, ransomware, security, suspicious links, updatesOphtek, LLC

Feb 2023

There’s a lot of money to be made in hacking and threat actors are now turning it into a business with Ransomware as a Service (RaaS).

Ransomware, of course, is well known to anyone who steps online in the digital age. With the ability to encrypt your data and demand a ransom fee, it has not only generated headlines, but also caused significant headaches for business owners. And, with ransomware attacks increasing by 41% in 2022, it’s a strategy which is showing no signs of slowing up. Therefore, not only do you need to be aware of ransomware, but you also need to keep up with associated developments such as RaaS.

As RaaS has the potential to create attacks which are both wider ranging and easier than before, it’s crucial you understand how it operates

The Basics of Ransomware as a Service

We’re all aware of what ransomware is, but what is RaaS? After all, surely ransomware is the opposite of a service? Unfortunately, for PC owners, ransomware software and attacks are now available for hire in the form of RaaS. Similar to Software as a Service (Saas) – examples of which include Gmail and Netflix – RaaS allows threat actors to harness the power of hacking tools without having to design them. If, for example, a threat actor doesn’t have the time (or skills) to build a ransomware tool, what do they do? They purchase one.

Typically, RaaS kits are found on the dark web, so don’t expect to find them taking up space on Amazon. Depending on the sophistication of the RaaS, the cost of purchasing them can range between $30 – $5,000. Threat actors looking to purchase RaaS are also presented with several different purchasing options such as one-time fees, subscription tiers or even affiliate models. It’s estimated that over $10 billion exchanges hands each year – mostly in cryptocurrency – for RaaS kits.

Examples of RaaS include Black Basta, LockBit and DarkSide, with more available for those looking to unleash ransomware easily and quickly. These RaaS kits are also much more than just hacking software, they also offer user forums and dedicated support teams to help customers get the most out of their ransomware. Again, this is very similar to the way in which successful SaaS developers provide extra value for their product. However, whereas SaaS is provided by legitimate developers, RaaS tends to be created by criminal gangs with the sole intent of generating illegal funds.

Staying Safe from Ransomware as a Service

The end result of an RaaS attack is the same as a standard ransomware attack, so there’s nothing specific you need to do if an attack comes through RaaS. Instead, you just need to stick to good old fashioned ransomware security practices:

Update your software: if a vulnerability is present within your software, then there’s a risk this could be exploited, and ransomware given full access to your data. To counter this, make sure that you have automatic updates approved on your PC to keep it as secure as possible.
Don’t click suspicious links: you should only ever click a link if you know exactly what you are clicking on and where it will take you. Always hover your mouse cursor over a link to reveal its true destination. All it takes is for one malicious click to be activated to launch a ransomware attack.
Always back up your data: falling victim to a ransomware attack only means your data is lost if you haven’t backed it up. Therefore, save yourself a financial headache by making sure multiple backups are in place to minimize any data loss.

For more ways to secure and optimize your business technology, contact your local IT professionals.

1 2 Next »

CoffeeLoader Malware: Hiding in Your GPU

SnipBot Malware Used to Steal Data from Victims

Google Accounts Compromised by Cookie Vulnerability

What is Ransomware as a Service?

Category Archives: Suspicious links