The cybersecurity company eSentire has just issued a warning about a new attack that attempts to infect computers through false browser updates. The attack begins when the user comes across an infected web page. This tells him that he is using an old version of his browser, and shows him a button to update it. The page adapts to the browser used, for example Google Chrome, Mozilla Firefox or MicrosoftMicrosoft Edge. In reality, the user downloads the update.zip archive, which contains two pieces of malware.
The first malware is called Lumma Stealer, known since August 2022. This targets cryptocurrency wallets, browser extensions fortwo-factor authenticationtwo-factor authentication, as well as other sensitive data. Late last year, it was even updated to steal accounts GoogleGoogle by appropriating the CookiesCookies session.
Do not download a browser update from a web page
The second malware is called BitRAT, and steals data and entries from keyboardkeyboard (keyloggerkeylogger)). It can even transmit live the image of the webcamwebcam and microphone audio stream, mine cryptocurrencies and provide remote access for hackers.
eSentir had already launched an alert in April about a similar campaign, which starts from the same fake browser update page. However, for this one, the malware used is the FakeBat loader, a tool that allows other malware to be loaded on demand, and generally rented to hackers who do not have the skills to infect computers themselves.
To avoid these attacks, make sure you have a anti-virusanti-virus up to date, and above all never click on a page that offers you an update for your browser. These softwaresoftware update automatically, and if in doubt, simply open the main menu, then the Help section, and click on the About option. A page shows you the version number of your browser and whether it is up to date.
