Oyster Backdoor Spreading via Trojanized Popular Software Downloads

[Passages]

Jun 21, 2024
Newsroom

A malvertising campaign is leveraging trojanized installers for popular software such as Google Chrome and Microsoft Teams to drop a backdoor called Oyster (aka Broomstick and CleanUpLoader).

That's according to findings from Rapid7, which identified lookalike websites hosting the malicious payloads that users are redirected to after searching for them on search engines like Google and Bing.

The threat actors are luring unsuspecting users to fake websites purporting to contain legitimate software. But attempting to download the setup binary launches a malware infection chain instead.

Specifically, the executable serves as a pathway for a backdoor called Oyster, which is capable of gathering information about the compromised host, communicating with a hard-coded command-and-control (C2) address, and supporting remote code execution.
https://thehackernews.com/2024/06/oyster-backdoor-spreading-via.html

[Tetrachloride]

1. And so..... who is letting this happen

[Passages]

2. The attacks are increasingly more sophisticated.

[John1956PA]

3. I agree. Downloading software is risky.

Nefarious parties will spoof up a side to make it look as though it is managed by a legitimate company. Other than a browser which I downloaded a few years ago, I gave avoided downloading programs.