malware Archives

Fake Job Scam Used to Serve Up Malware

fake recruiters, Linkedin, malicious websites, Ophtek, phishing_email, update security software, verify identities, webcamsLinkedin, malware, Ophtek, phishing, security, updatesOphtek, LLC

Jan 2025

Threat actors are highly innovative – one recent attack tricked victims into addressing fake webcam and microphone issues to gain system access.

We’re constantly advised to be aware of phishing emails, infected documents, and malicious websites, but what happens when threat actors take a different approach? Well, they increase their chances of breaching your defenses. This is why it’s crucial to keep up to date with developments in the world of cybersecurity. This latest attack targeted professionals on LinkedIn, but it could easily be used in other environments.

O phtek wants to keep you secure from these types of threats, so we’re going to summarize this attack and show you how to stay safe.

The Interview from Hell

Job interviews are always stressful affairs, but at least they don’t hit you financially. However, there is an exception – the LinkedIn attack. With 1 billion members, LinkedIn is hugely popular and this makes it the perfect target for a threat actor.

Victims are approached on LinkedIn by fake recruiters who claim to be working for crypto firms such as Kraken and Gemini. On offer is the opportunity of a number of high-ranking roles at these firms, and the victims has been specially chosen to apply. Victims who take the bait and then posed a series of long-form questions relating to the crypto industry e.g. which crypto trends will have the most impact in the next 12 months.

It may, at first, seem like any other job interview, but the final question posed requires an answer filmed on video. This is where the breach begins. The threat actor will issue an error message stating that there’s an access issue for the victim’s camera and microphone. The problem is apparently caused by a cache issue but, luckily, the ‘interviewer’ has a set of instructions to fix the error. Unfortunately, following these instructions simply hands the threat actor access to the victim’s PC, where their crypto wallet is likely to be targeted.

How to Stay Safe on LinkedIn

You may have a LinkedIn account, and even if you don’t, it’s important that you know how to defend against a similar attack. The three main ways you can protect your PC are:

Always Verify Identities: Unsolicited job offers aren’t unusual on LinkedIn or other social networking sites, but this doesn’t mean they’re always legitimate. Therefore, it’s vital that you carry out research on the recruiter’s identity. Start by contacting the company directly – ideally by telephone – through official channels and confirm that the vacancy offer is genuine. This can help prevent you falling victim to fake recruiters.
Check IT Issues with Professionals: Taking technical IT instructions from strangers online is a sure-fire way to open up your PC to an attack. Anything which involves adjusting system settings or installing software should be scrutinized closely. Even if someone asks you to install a new font on your PC, treat it as suspicious. Rather than following through on the advice of an internet stranger, go straight to one of your verified IT professionals for advice.
Keep Security Software Updated: Ensure that your operating system and associated antivirus software is always kept up to date. Installing the latest security patches will always maximize your security in the event of a breach, so automating these updates is your best form of defense.

For more ways to secure and optimize your business technology, contact your local IT professionals .

Microsoft Defender Caught Out by Fake Gaming Malware

cryptocurrency, cryptojacking, data harvest, Defender, malware, Malwarebytes, Ophtek, Orbit Unitcryptocurrency, cryptojacking, data harvest, Defender, malware, Malwarebytes, Ophtek, Orbit UnitOphtek, LLC

Dec 2024

Microsoft Defender is an app whose objective is to defend against malware, but what happens when malware outsmarts it?

We’ve all heard the headlines about the volatile world of NFTs, but a new development is that they’re being used to help spread malware. In a particularly extreme case, one PC user thought they were downloading an NFT game, but the only thing which got played was the victim’s Google account. As a result of the Google account being hijacked, the victim ended up losing over $24,000 in cryptocurrency.

This incident, as with many other scams, relied on a momentary lapse of judgement, so we’re going to put it under the spotlight to see what we can learn.

How Did an NFT Game Carry Out a Robbery?

The attack started when the victim received a message from a stranger over Telegram, an encrypted messaging service which prides itself on the anonymity it provides users. The message urged the victim to download a blockchain game called Orbit Unit. Deciding that the message was harmless and the recommendation worthy of investigation, the victim downloaded Orbit Unit and installed it.

Unfortunately, the download was fake and riddled with malware. Once activated, the malware went on to install a malicious Chrome extension. Housed within the Chrome browser, the extension was titled Google Keep Chrome Extension, in an attempt to mimic the genuine Google note keeping app. The malicious app certainly fulfilled its promise of taking notes but did so in a way which compromised the victim’s data. All data entered into Chrome, be it login credentials, cookies, or browser history, was harvested by the malware.

For the victim, it was particularly frustrating as they had Malwarebytes on their PC and it failed to detect the malware. This has been attributed to the victim most likely having the free version of Malwarebytes, where real-time protection isn’t activated. What they did have, though, was Microsoft Defender, an app which promises to help “individuals and families protect their personal data and devices.” In this instance, Microsoft Defender failed spectacularly.

The threat actor behind the malware was able to access the victims Google passwords through Chrome and gain access to their cryptocurrency wallets. It was from here that they were able to steal $24,000 worth of cryptocurrency.

Staying Safe When Malware Protection Fails

You and your employees may not deal in cryptocurrency, but this cyberattack demonstrates the importance of being able to identify a potential attack and protect your data. Therefore, make sure you practice these best security practices:

Don’t Click Suspicious Links: Any links you receive via email, websites, or mobile devices should always be scrutinized closely before clicking. If they originate from an unknown sender or use unusual language with a sense of urgency to click, you need to get them verified by an IT professional in order to prevent downloading malware.
Use Real Time Protection Software: Installing anti-malware software should always be a priority, but you need to make sure you’re using one with real-time protection tools. This ensures that malware is identified and stopped in its tracks before it can activate its malicious payload.
Don’t Use Autologin on Chrome: Sure, it saves you a few minutes over the course of a week, but the autologin feature on Chrome also sets you up to fail. This tool stores login tokens in your browser and means you don’t have to use your password to access sites each time. However, if a threat actor gains access to them – as they did in the attack on LinusTechTips – they can gain access to all of your accounts. Learn how to turn autologin off in this guide.

For more ways to secure and optimize your business technology, c ontact your local IT professionals.

Infostealer malware is frequently referenced as the go-to weapon for threat actors, but what is it? And how do you protect your IT systems from it?

You only have to take a quick look over the Ophtek blog to understand the popularity of infostealers in modern hacking. From fake Zoom sites through to SnipBot and SambaSpy, threat actors are determined to get their hands on your sensitive data. Infostealers, therefore, present an everyday threat to PC users and it’s crucial you understand their methods and impact.

Luckily, Ophtek has your back, and we’re going to take a deep dive into infostealers to equip you with the knowledge you need to stay safe.

What is an Infostealer?

The main objective of all infostealer malware is to harvest confidential data from a compromised system. With this stolen data, threat actors have the opportunity to conduct numerous crimes such as identity theft or financial damage. This makes infostealer malware such a serious threat, especially in the age of big data, where organizations hold huge amounts of data on their IT systems. As with most modern malware, infostealer has strong stealth capabilities, allowing it to operate in the background without being detected and strengthening its impact.

The Danger Behind Infostealers

Infostealers can be individual malware threats or part of a more extensive suite of malware applications. Whatever their method, infostealers tend to focus on stealing the following data:

System login credentials
Social media and email passwords
Bank details
Personal details

All of these data categories have the potential for serious damage e.g. hacking someone’s personal emails and reading confidential information or clearing someone’s bank account out. From a business perspective, infostealers also have the potential to gain access to secure areas of your IT infrastructure and compromise the operations of your business. All of this data is taken directly from your servers and then discreetly transmitted to a remote server set up by the threat actors.

How Do Infostealers Strike?

Threat actors have developed numerous strategies to launch successful infostealer attacks with the two most common methods being:

Phishing Emails: 3.4 billion phishing emails are sent every day, so it’s fair to say they’re an incredibly popular route for malware. These highly deceptive emails will contain either malicious links or attachments which, when activated, expose the recipient to malware downloads.
Malicious Sites: As seen in our article on fake Zoom sites, threat actors regularly set up malicious websites in order to lure visitors into downloading either fake updates or complete applications. However, these downloads are never genuine and only contain malware such as infostealers.

Protecting Your Systems Against Infostealers

Despite the threat of infostealers, it’s relatively easy to stay safe and protect your systems from them. All you need to do is follow these best practices:

Be Wary of Suspicious Emails: Any emails which ring even the slightest alarm bell should be closely scrutinized. If something about the wording doesn’t sound quite right, or there’s a sense of urgency to commit to an action, the chances are that this could be a phishing email. In these instances, don’t click anything and, instead, contact an IT professional to review the content.
Always Update Your Software: One of the easiest ways for threat actors to deploy infostealers on your system is through software vulnerabilities. No piece of software is perfect, and they often contain weak spots which can be exploited. However, as these vulnerabilities are picked up by the developers, security patches are issued to remedy these weak spots. Accordingly, installing these updates should be a major priority.
Install Security Software: There are numerous security packages available such as AVG and Kaspersky which monitor your systems in real time and can block malware threats instantly. This automatic defense enables you to stay safe from infostealers and keeps your networks healthy and productive.

For more ways to secure and optimize your business technology, c ontact your local IT professionals.

The headlines generated by cybersecurity attacks always focus on the damage caused by hackers, but who exactly are the hackers and why do they hack?

Financial losses associated with cybercrime hit a mighty $12.5 billion in 2023, so it’s clear to see that hackers have a major impact on society. And yet we know so little about them. Characterized as shady, hidden figures, hackers rely on this mysterious air to create panic and fear when they strike. Technically savvy, they pose a major threat to computer systems all over the world, and they often get away with it through a mixture of ingenuity and bravado.

To help you understand their motives better, we’re going to pull back the digital curtain and show you who these hackers are and what drives them to attack IT infrastructures.

The Main Types of Hackers

There are many different types of hackers, with different methods of operation and varying skillsets. The main variants you’re likely to encounter are:

Black Hat Hackers: Perhaps the most infamous type of hacker, black hat hackers are regularly discussed on the Ophtek blog due to their love of breaking into IT systems. Their main activities involve launching malware, compromising software vulnerabilities, and setting up phishing campaigns.
White Hat Hackers: In contrast to their black hat counterparts, white hat hackers are a force for good. Typically, they work in conjunction with organizations to identify weak spots in their IT security e.g. demonstrating where software vulnerabilities are present or highlighting the use of default passwords on routers.
Hacktivists: These hackers aren’t out to commit cybercrime in the same way as a black hat hacker, but hacktivists operate on the wrong side of the law in order to bring about social or political change. A good example of this can be found in the 2022 attacks launched against Russian websites by the hacking group Anonymous, an attack designed in response to the Russian war on Ukraine.

What are the Motivations Behind Hacking?

Every hack will have a motive behind it and it’s important to understand these motives in order to better protect our computer systems. The main driving forces behind cyberattacks include:

Financial Gain: As with all crime, money acts as a significant motivating factor. Stolen credentials, for example, can be sold on the dark web for large amounts of cash. Likewise, the rise of Malware-as-a-Service has proved highly lucrative for hackers and been responsible for some devastating attacks.
Challenging Themselves: Hackers love the prestige of a successful hack, and this hit of dopamine is enough to encourage them to set about launching increasingly audacious attacks. This not only challenges them and provides a firm motivation, but it also encourages them to hone their skills and make their attacks harder to defend against.
Personal Grievances: Often, the main motivation behind a hack is simply a slice of old-fashioned revenge. An ex-employee, perhaps terminated unfairly in their eyes, may seek revenge by exploiting their knowledge of an organization’s IT system. This insider knowledge may offer them the opportunity to strike back and hurt the organization.

Final Thoughts

Hackers, with their varying objectives and motivations, are a complex set of individuals and groups. While some may be a force for good, just as many have taken up their craft to inflict damage and benefit financially from their digital chaos. Whatever their circumstances, one thing remains clear: it’s crucial to strengthen your IT systems against all threats all the time.

For more ways to secure and optimize your business technology, contact your local IT p rofessionals.

Hackers have designed fake Google Meet error pages to distribute info-stealing malware which can compromise all the data on a network.

It feels as though malicious websites are springing up on a daily basis, and with 12.8 million websites infected with malware, this is a fair assumption to make. The latest attack under the Ophtek spotlight centers around Google Meet, a videoconferencing service hosted online by Google. The threat uses fake connectivity errors to lure victims into inadvertently launching the malware on their own system. And with Google Meet having over 300 million active users every month, the chance of this campaign tripping people up is exceptionally high.

The Danger of Fake Google Meet Pages

Google Meet attack appears to be part of a wider hacking campaign known as ClickFix, which has also been identified using similar fake websites impersonating Google Chrome and Facebook. In all these cases, the objective of the campaign is to install info stealers onto infected PCs. Malware used in these attacks include DarkGate and Lumma Stealer.

Fake error messages are displayed in the web browsers of victims to indicate a connectivity issue with a Google Meet call. However, there is no Google Meet call taking place, it’s simply a ruse to deceive victims into following through on a malicious call-to-action. These ‘errors’ recommend copying a ‘fix’ and then running it in Windows PowerShell, an app commonly used to automate processes on a Microsoft system.

Unfortunately, rather than fixing the ‘error’ with Google Meet, the execution of this code within PowerShell simply downloads and installs the malware. Once installed, malware such as DarkGate and Lumma Stealer has the potential to search out sensitive data on your network, establish remote network connections, and transmit stolen data out of your network.

Victims are redirected to these malicious websites via phishing emails, which claim to contain instructions for joining important virtual meetings and webinars. The URLs used within the emails appear like genuine Google Meet links but take advantage of slight differences in the address to deceive recipients.

Protecting Yourself from Fake Google Meet Malware

The best way to stay safe in the face of the fake Google Meet pages (and similar attacks) is by being proactive and educating your staff on the threats of malicious websites. Accordingly, following these best practices gives you the best chance of securing your IT infrastructure:

Double Check URLs: malicious websites often mimic genuine ones to catch people off guard. Therefore, always verify any URL for anything unusual such as misspelled words or lengthened and unusual domain endings, before clicking them. This will minimize your risk of falling victim to phishing and malware attacks.
Use Browser Security Features: many browsers, such as Google Chrome, come with built-in security features which can block sites known to be harmful or detect suspicious downloads. If you have these protections enabled, and this is easily done through your browser settings, you can rest assured you’re putting a strong security measure in place.
Install Antivirus and Firewall Software: one of the simplest way to protect yourself is by installing antivirus and firewall software, which is often available for free in the form of AVG and Kaspersky. This software can not only detect malware, but also block it before it reaches your system, so it can be considered a very strong form of defense.

For more ways to secure and optimize your business technology, contact your local IT profes sionals.

1 2 3 … 30 Next »

Fake Job Scam Used to Serve Up Malware

Microsoft Defender Caught Out by Fake Gaming Malware

Infostealers: What They Are and How to Stay Protected

Hackers Unmasked: Who Are They and What Motivates Them?

Fake Google Meet Pages Used to Spread Malware

Tag Archives: malware