Threat actors have turned to Facebook ads to unleash NodeStealer on unsuspecting victims, and they’re using scantily clad women to achieve this.
Facebook is no stranger to finding its ad network compromised to spread malware, but what’s interesting about this latest campaign is that it primarily targets males. At the core of this attack is NodeStealer, a strain of malware which has been active for several months. However, NodeStealer has changed. At the start of its existence, it was designed in JavaScript, but it’s now being coded with the Python programming language.
How Does NodeStealer Target its Victims?
Using marketing strategies almost as old as time, the threat actors behind NodeStealer have used the provocative lure of female flesh to entice their victims. Taking advantage of the massive reach of Facebook’s ad network, these threat actors have created adverts which contain revealing photos of young women. The objective of these adverts is to encourage people to click on them, a process which will download an archive of malicious files.
One of these files is called Photo Album.exe but, far from containing any photos, it simply downloads a further executable file which unleashes NodeStealer. With NodeStealer running rampant on an infected system, it will begin harvesting login credentials and, in particular, it will attempt to take control of Facebook business accounts. With further business accounts compromised, NodeStealer can launch even more malicious ad campaigns and spread itself further.
Stay Safe from the Threat of NodeStealer
NodeStealer is a classic example of malware deceiving its victims to achieve its goal. And it’s not surprising to hear that the 18 – 65 male demographic have made up the majority of its victims. Regardless of the bait, however, NodeStealer provides us with a number of interesting lessons to learn. The most important takeaways should be:
- Block social media sites: the NodeStealer campaign is the perfect example of why corporate networks should block social media sites. Yes, certain businesses will need to access these sites for marketing reasons, but general access should be shut down to employees.
- Educate on phishing techniques: the threat actors behind NodeStealer have used typical phishing techniques to convince unsuspecting users that they should click on their ads. And this is where you need to educate your employees. Demonstrate how if it sounds too good to be true, then it almost always is. Make this not just part of your IT inductions, but also as regular refreshers to keep employees on their guard.
- Always double check links: the malicious links contained in adverts will usually direct people to a different destination than promised. This means it’s crucial you understand the importance of checking links before clicking them. The simplest way to do this is by hovering your mouse cursor over links to reveal their true destination. And, always remember, if in doubt about a link (or advert), check with an IT expert before clicking it.
For more ways to secure and optimize your business technology, contact your local IT professionals.
