IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

New malware uses search engine ads to target pirate gamers

MosaicLoader uses advanced obfuscation techniques to avoid detection

Skull and crossbones on a computerized background

A new piece of malware uses paid advertisements in search results to target users searching for pirated software. It uses sophisticated techniques to hide its presence while dropping a Pandora's box of malicious programs onto victims' systems. 

Security company Bitdefender detailed the MosaicLoader software’s inner workings, which mimics legitimate games-related software to avoid detection. 

Bitdefender's report found the initial malware dropper stored in archives that pretend to offer cracked software installers. The company said cyber criminals appear to be purchasing pay-per-click (PPC) advertisements related to pirated software then inserting these links to the malware droppers into their ads. 

The initial program acts as an installer for “malware sprayer” software that it downloads from a command-and-control (C2) server. This malware comes from a list of sources maintained by the criminals behind the software, which include URLs dedicated to hosting malware files and public Discord channels. 

The malware the program installs includes simple cookie stealers that can be used to hijack victims' online sessions. They can exfiltrate Facebook login data, enabling cyber criminals to take over a victim's account, making posts that damage a victim's reputation or spread malware further. 

Other malware the dropper installs include cryptocurrency miners and the Glupteba back door, which is a botnet program that launches multiple attacks on browsers and home routers and takes its instruction via the Bitcoin blockchain. 

Related Resource

Aberdeen Report: How a platform approach to security monitoring initiatives adds value

Integration, orchestration, analytics, automation, and the need for speed

White text against a pink-red background - whitepaper from IBMFree download

After downloading its initial files, the malware dropper uses PowerShell to exclude them from Windows Defender's anti-malware scanner. Then, it registers an executable in the Windows registry and installs a service to reinsert that entry if the user removes it. 

BitDefender's analysis shows the malware using plenty of tricks to avoid detection. It creates folders that look like gaming directories to store its files and uses processes that look like they're running software from GPU vendor NVIDIA. 

The malware also obfuscates its activities by breaking its code into small chunks and jumping between them. It also uses mathematical operations with large numbers to generate data the program needs, making its code look more like chunks of data. It also includes filler data that does nothing but introduce more noise into the code, making it harder for security researchers to debug. 

In stark contrast to their code obfuscation, the malware authors hard-coded their C2 server’s URL. This enabled the researchers to find the server's IP address and link it to several other malware campaigns. 

Featured Resources

Accelerating healthcare transformation through patient-centred medtech solutions

Seize the digital transformation opportunities to streamline patient care and optimise patient outcomes

Free Download

Big payoffs from big bets in AI-powered automation

Automation disruptors realise 1.5 x higher revenue growth

Free Download

Hyperscaler cloud service providers top ten

Why it's important for companies to consider hyperscaler cloud service providers, and why they matter

Free Download

Strategic app modernisation drives digital transformation

Address business needs both now and in the future

Free Download

Recommended

Getting board-level buy-in for security strategy
Whitepaper

Getting board-level buy-in for security strategy

30 Nov 2022
Best free malware removal tools 2022
Security

Best free malware removal tools 2022

28 Nov 2022
2022 IBM's Security X-Force cloud threat landscape report
Whitepaper

2022 IBM's Security X-Force cloud threat landscape report

22 Nov 2022
2022 Magic quadrant for Security Information and Event Management (SIEM)
Whitepaper

2022 Magic quadrant for Security Information and Event Management (SIEM)

22 Nov 2022

Most Popular

Empowering employees to truly work anywhere
Sponsored

Empowering employees to truly work anywhere

22 Nov 2022
Salesforce co-CEO Bret Taylor resigns with cryptic parting message
Business operations

Salesforce co-CEO Bret Taylor resigns with cryptic parting message

1 Dec 2022
Netherlands urges citizens to prepare survival kits in case hackers target critical infrastructure
cyber attacks

Netherlands urges citizens to prepare survival kits in case hackers target critical infrastructure

2 Dec 2022