Hackers use Memes on Twitter - Sending Secret commands as Malware
By MYBRANDBOOK
A new strain of malware has been discovered that takes its instructions from code hidden in memes posted to Twitter and takes screenshots of the infected system.
How does it work?
The hacker has been using “What if I told you” meme to secretly tell a Windows-based malware when to take screenshots from infected systems.
The malware quietly infects a vulnerable computer, takes screenshots and send it back to the malware’s command and control server. He has used steganography techniques to hide the command “/print” in the image, which told the malware when to take a screenshot of a system. The malware then obtains the address where its command and control server is located and send the screenshots back to the server.
Other hidden commands the hacker could’ve sent through the memes include “/clip” to capture clipboard copied content, and “/processors” to retrieve a list of running processes over the PC.
The malware itself is relatively underwhelming: like most primitive remote access trojans (RATs), the malware quietly infects a vulnerable computer, takes screenshots and pulls other data from the affected system and sends it back to the malware’s command and control server.
Twitter has disabled the hacker's account on its platform. But it isn't clear still not how the attacker was circulating the malware, a Trojanized .exe file.
With a reference to the Comments on a blog post from Ankush Johar, Director at Infosec Ventures, a venture fund that invests in innovative cybersecurity platforms that solve big problems. Current investments include bugsbounty.com, humanfirewall.io and emailauth.io.
Attackers are always trying to find new methods to work around detection systems such as anti-viruses, intrusion detection systems and anomaly detection systems, all of which are trained to detect certain kind of pattern/anomalies suggesting malware activity.
As seen in the past, hackers have been using use popular service like Google Drive, Dropbox etc to hide malware snippets and commands as these are websites that are generally not considered suspicious and that's the same reason why hacker has chosen Twitter in this case.
This goes on to show that even having the best detection and prevention system is not enough. Protecting from an infection in the first place is what is most important. Such malware mostly spread via pirated websites and phishing attacks. Humans are the weakest link in cybersecurity and hence that's the easiest link for hackers to exploit. The security of users lies in their own hands and the only way to be secure is to be vigilant and suspicious by nature.
Users are suggested to completely avoid pirated content based websites and stay extremely cautious with emails with attachments, links or asking to download a file. Having a good antivirus always helps but not more than having an eye for detecting phishing attacks.
Farrhad Acidwalla, founder of CYBERNETIV DIGITAL - Forward Thinking Cyber Security and Research, says: 2019 is here, and the quantum of global hacks has Internet consumers unquestionably more cognizant of security and privacy issues than they were a year or two ago. Twitter knows user trust is critical and notified users as a measure of transparency. While this took a hit on their stock price, consumers need platforms to be on top of incidents where global attacks could be distributed through them. While core Twitter was not hacked, the malicious attackers used it as a distribution platform to send commands to their malware on infected devices.
Twitter did not rule out the possibility of a state-sponsored background to this suspicious activity. The security community knows it has to stay ahead of the curve with the growing sophistication of attacks world over. The bright side here is that this has come to light before reaching any known mass exploitation.
Singapore to remove One-Time Passwords from Bank Accounts
According to the Monetary Authority of Singapore, clients who utilise secur...
Is 375 million Airtel subscribers database breached?
When a hacker claims to have accessed and put up for sale a customer databa...
The government of India intends to construct a single portal f
A single portal will be launched by the Indian government to list all of it...
OpenAI offers GPT-4o, a faster model available to all users at
GPT-4o, a faster and more sophisticated AI model, is made available to all...
Icons Of India : Girish Mathrubootham
Girish Mathrubootham is the Founder of Freshworks (previously known ...
Icons Of India : Bhavish Aggarwal
Indian entrepreneur Bhavish Aggarwal is the CEO of Ola, India’s larg...
Icons Of India : Kumar Mangalam Birla
Aditya Birla Group chairman Kumar Mangalam Birla recently made a comeb...
IFFCO - Indian Farmers Fertiliser Cooperative
IFFCO operates as a cooperative society owned and controlled by its fa...
BSE - Bombay Stock Exchange
The Bombay Stock Exchange (BSE) is one of India’s largest and oldest...
RailTel Corporation of India Limited
RailTel is a leading telecommunications infrastructure provider in Ind...
Indian Tech Talent Excelling The Tech World - Thomas Kurian, CEO- Google Cloud
Thomas Kurian, the CEO of Google Cloud, has been instrumental in expan...
Indian Tech Talent Excelling The Tech World - Steve Sanghi, Executive Chair, Microchip
Steve Sanghi, the Executive Chair of Microchip Technology, has been a ...
Indian Tech Talent Excelling The Tech World - Aman Bhutani, CEO, GoDaddy
Aman Bhutani, the self-taught techie and CEO of GoDaddy, oversees a co...