BazarLoader malware abuses Windows 10 apps in 'Call Me Back' attack

The highly targeted phishing campaign abuses appxbundle to infect devices

A new phishing campaign is abusing an app feature in Windows 10 to spread the BazarLoader malware.

The campaign’s discovery came when employees started receiving the malware-laden emails, according to security researchers at Sophos.

One email appeared to be sent by a "Sophos Main Manager Assistant” called "Adam Williams.” In the email, the person demanded to know why the recipient hadn't responded to a customer's complaint, which appeared as a PDF link in the email.

However, if a victim clicked on the link, it downloaded and installed the BazarLoader malware. Researchers said this malware was delivered by abusing a novel mechanism, the Windows 10 apps installer process.

The researchers said the phishing campaign sends victims to a website sporting the Adobe logo to look more legitimate. The text on the page asks victims to click on a link to preview the alleged PDF.

“But there’s something amiss with this link: Instead of being prefixed with the expected https:// the link instead begins with what was (for me, at least) an unfamiliar ms-appinstaller: prefix,” said SophosLabs Principal Researcher Andrew Brandt.

"In the course of running through an actual infection I realized that this construction of a URL triggers the browser [in my case, Microsoft's Edge browser on Windows 10], to invoke a tool used by the Windows Store application, called AppInstaller.exe, to download and run whatever's on the other end of that link," he added.

Related Resource

How to reduce the risk of phishing and ransomware

Top security concerns and tips for mitigation

Large letter 'O' against a background of a city - whitepaper from MimecastFree download

This link points to a 482-byte text file named Adobe.appinstaller. The contents of that file are just plain text, in XML format, that points to a URL where a larger file containing the malware, named Adobe_1.7.0.0_x64.appbundle, was located.

The malicious appinstaller indicates the .appxbundle was digitally signed by a UK-based company calling itself Systems Accounting Limited. This certificate was issued several months ago, and Sophos contacted Sectigo to alert it about this abuse of the certificate it issued.

Victims then get asked to allow an "Adobe PDF Component” install. If this is allowed, Bazarloader is installed.

“Malware that comes in AppX packages is novel, but now that the process has been demonstrated, it’s likely to be here to stay. These apps are supposed to be digitally signed with certificates, but it doesn’t appear that there’s any mechanism to make a sanity check between what’s on the certificate and the code it’s supposed to certify,” said Brandt.

Featured Resources

2021 Thales cloud security study

The challenges of cloud data protection and access management in a hybrid and multi cloud world

Free download

IDC agility assessment

The competitive advantage in adaptability

Free Download

Digital transformation insights from CIOs for CIOs

Transformation pilotes, co-pilots, and engineers

Free download

What ITDMs did next - and what they should be doing now

Enable continued collaboration and communication for hybrid workers

Recommended

Hackers publish Vestas data following cyber attack
cyber attacks

Hackers publish Vestas data following cyber attack

9 Dec 2021
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

8 Dec 2021
Google files lawsuit against Russian botnet operators
hacking

Google files lawsuit against Russian botnet operators

8 Dec 2021
Trend Micro Worry-Free Business Security review: Great cloud-managed malware protection
endpoint security

Trend Micro Worry-Free Business Security review: Great cloud-managed malware protection

7 Dec 2021

Most Popular

What are the pros and cons of AI?
machine learning

What are the pros and cons of AI?

30 Nov 2021
How to move Microsoft's Windows 11 from a hard drive to an SSD
Microsoft Windows

How to move Microsoft's Windows 11 from a hard drive to an SSD

24 Nov 2021
What is single sign-on (SSO)?
single sign-on (SSO)

What is single sign-on (SSO)?

2 Dec 2021