Fake AnyDesk Google ads deliver malware

Malware pushed through Google search results

Hackers are pushing a bogus version of a remote desktop app AnyDesk through search results on Google. The fake app contains a trojan that is part of a new campaign designed to control a victim's computer.

Researchers at CrowdStrike first spotted the malware last month. Researchers said the suspicious file masquerading as AnyDesk called "AnyDeskSetup.exe" was being written to disk and exhibiting suspicious behavior.

The executable wasn't a legitimate version but had been weaponized with additional capabilities. To evade detection by Google's advert security, the malware attempted to launch a PowerShell script that had been renamed rexc.exe to bypass detection.

Researchers reviewed the process and found "AnydeskSetup.exe'' running from the user's Downloads directory. They said this wasn't the normal version of the application, as it was signed by Digital IT Consultants Plus Inc. instead of AnyDesk creators, philandro Software GmbH. The network activity generated by the application was to a domain (anydeskstat[.]com) registered on April 9, 2021 and hosted at a Russian IP address.

When executed, a PowerShell implant was written to %TEMP/v.ps1 and executed with a command-line switch of "-W 1" to hide the PowerShell window. At this point, researchers launched a thorough investigation and found the PowerShell script the hackers used was similar to another piece of malware hiding as a Zoom installer in April.

Related Resource

Reduce management overhead by transforming VDI and app management

How to support a distributed workforce with VMware Horizon Control Plane

Reduce management overhead by transforming VDI and app management  - whitepaper from VMWareDownload now

"The logic we observed is very similar to logic observed and published by Inde, where a masqueraded Zoom installer dropped a similar PowerShell script from an external resource," said researchers.

The malvertising campaign itself sends victims to a URL clone of the legitimate AnyDesk website and provides a download link for the trojan installer. Researchers found three intermediary websites used in this campaign.

Researchers said the hackers are spending $1.75 per click, but this doesn't equate to getting a shell on a target they're interested in.

"While it is unknown what percentage of Google searches for AnyDesk resulted in clicks on the ad, a 40% Trojan installation rate from an ad click shows that this is an extremely successful method of gaining remote access across a wide range of potential targets," said researchers.

Researchers notified customers and alerted Google to the malvertising campaign. "It appears that Google expeditiously took appropriate action because, at the time of this blog, the ad was no longer being served," researchers said.

Featured Resources

Modern governance: The how-to guide

Equipping organisations with the right tools for business resilience

Free Download

Cloud operational excellence

Everything you need to know about optimising your cloud operations

Watch now

A buyer’s guide to board management software

Improve your board’s performance

The real world business value of Oracle autonomous data warehouse

Lead with a 417% five-year ROI

Download now

Recommended

UK's first government cyber strategy aims to bolster public sector defences
cyber security

UK's first government cyber strategy aims to bolster public sector defences

25 Jan 2022
Russia's "politically motivated" REvil raid could be used as leverage, experts warn
ransomware

Russia's "politically motivated" REvil raid could be used as leverage, experts warn

17 Jan 2022
Meta files lawsuit to uncover hackers targeting Facebook, WhatsApp
phishing

Meta files lawsuit to uncover hackers targeting Facebook, WhatsApp

21 Dec 2021
Five things to consider before choosing an MFA solution
Security

Five things to consider before choosing an MFA solution

17 Dec 2021

Most Popular

How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

6 Jan 2022
Sony pulls out of MWC 2022
Business operations

Sony pulls out of MWC 2022

14 Jan 2022
Dell XPS 15 (2021) review: The best just got better
Laptops

Dell XPS 15 (2021) review: The best just got better

14 Jan 2022