Our team invests countless hours in the exploration, discovery and investigation of emerging trends such as AI and futuristic technology. Stay informed about the evolving landscape of cyberthreats through our diligent efforts and insights.

Security Evangelist at Gen

Research

Imagine you're going about your day when suddenly you receive an urgent message on Instagram. It's supposedly from “Meta’s Advertising Support Center,” warning you that your account is about to be disabled due to policy violations. The message includes official-sounding language, a Meta logo, a tight deadline (today!) and a link to “verify” your identity.&nbsp;That’s exactly what is happening to influencers and business owners daily, when they receive a message like the one below:&nbsp;

The messages are part of a growing wave of social engineering attacks designed to hijack Instagram accounts and steal access to their audiences.&nbsp;&nbsp;<h2>How the scam works&nbsp;</h2>When someone clicks on the link, they’re taken to a phishing site that mimics Meta’s interface. It asks the victim to “Request Review” to prevent their account from being disabled, a tactic that prompts them to enter their login details.&nbsp;

&nbsp;After submitting login information, the next step asks for their password.&nbsp;&nbsp;Since many people now have two-factor authentication (2FA) enabled, the attackers also try to steal that second layer of security by requesting the authentication code, all under the guise of “identity confirmation.”&nbsp;&nbsp;Once the scammers have the credentials and 2FA code, they immediately lock the victim out of their account, change the login info and take full control.&nbsp;<h2>Key elements of the scam&nbsp;</h2>&nbsp;This scam follows a typical phishing pattern. Here’s what to look for:&nbsp;<ol><li>Impersonation of authority: The scammers pose as a legitimate Meta entity — “Advertising Support Center.” The name sounds official, and they use a generic support logo to appear credible.</li><li>Urgent language: The message claims your Instagram and Facebook accounts will be disabled today due to violations, creating a sense of panic that pressures the victim into acting quickly.</li><li>Fake justification: The message states that the linked Facebook page doesn’t comply with Meta’s terms, suggesting a policy violation that needs to be resolved immediately.</li><li>Malicious link: The person is told to verify their account by clicking a suspicious URL. The domain looks vaguely like a Meta service (businessmetasuite.com-complaintsupportpage...click) but is clearly fake.</li><li>Phishing page: The link opens a page that mimics Meta’s interface and asks the victim to “Request Review” to prevent their account from being disabled. Victims are prompted to enter their login credentials.</li><li>2FA bypass: Since many Instagram accounts now have two-factor authentication (2FA) enabled, attackers know that just a password isn’t enough. These phishing pages are designed to also capture the second factor by requesting the code from the victim under the pretense of confirming their identity. This gives attackers everything they need to log in, bypass security and lock the victim out.&nbsp;</li></ol><h2>What the attackers are after&nbsp;</h2>In these scams, cybercriminals aren’t looking to steal passwords just for fun, they’re after influence, money and access. An account with thousands of followers, especially one used for professional purposes, is a very valuable asset. Once hijacked, it can be used to:&nbsp;<ul><li>Push scams to followers (like investment fraud, phishing links and fake giveaways)</li><li>Demand ransom from the original owner</li><li>Sell the account on underground markets&nbsp;</li></ul>The goal is to gain control of the account, lock the original owner out and monetize the audience.&nbsp;<h2>What to watch out for&nbsp;</h2>These scams can be surprisingly effective, especially for people who manage business or creator accounts. Here’s how to spot and avoid them:&nbsp;Red flags:&nbsp;<ul><li>Messages from accounts with very few followers or no verification badge</li><li>Urgent threats about account deletion or policy violations</li><li>Requests to click external links for “verification”</li><li>Grammatical errors or awkward phrasing&nbsp;</li></ul>Tips to stay safe:&nbsp;<ul><li>Never click on links in DMs from unknown accounts. Meta and Instagram will never ask you to verify your account via private message.</li><li>Check the sender’s profile. Official Meta accounts are verified and won’t have names like advertisingsupportcenter0798.</li><li>Use two-factor authentication on your accounts to prevent unauthorized access.</li><li>Report the account to Instagram if you receive one of these messages.</li><li>Educate your team. If you manage your account with others, make sure everyone knows how these scams work.&nbsp;</li></ul><h2>Why this matters&nbsp;</h2>For businesses and creators, Instagram isn’t just a social platform, it’s a channel for visibility, customer engagement and income. Losing access can have a direct financial impact.&nbsp;Scammers know this, and they’re getting better at creating convincing traps. The more awareness we raise, the harder it is for them to succeed.&nbsp;Stay alert, stay safe — and remember, real support never slides into your DMs.&nbsp;

Fake support messages are hijacking Instagram accounts. Here’s how the scam works and how to stay in control. 

Instagram Support Scams: How Criminals Trick You into Handing Over Your Account

Threat Researcher at Gen

<h2 class="text-align-justify">Key Points</h2><ul><li>Gen Threat Labs has discovered and analyzed an elaborate Traffic Direction System infrastructure delivering FakeCaptcha, tech scams and other malware campaigns to select users.&nbsp;</li><li>The campaign entry points are infected or otherwise attacker-controlled streaming websites, file sharing services, as well as malvertising campaigns.&nbsp;</li><li>Victims are evaluated based on geolocation, IP address, and browser fingerprinting; for example, connections through VPNs or headless browsers are detected and rejected.&nbsp;</li><li>The FakeCaptcha campaign is increasing its stealth by mimicking legitimate software websites.&nbsp;</li><li>A new variant of FakeCaptcha spreading information stealers and RATs avoids detection by employing Unicode math fonts.&nbsp;</li></ul>

<h2>Introduction</h2>The <a href="https://www.gendigital.com/blog/insights/research/global-surge-in-fake-captcha-attacks" target="_blank" rel="noreferrer noopener">FakeCaptcha campaigns</a> have become a widespread malware infection vector, using clever social engineering and exploiting internet users’ confusion about common CAPTCHA practices to trick victims into infecting their own computers, typically with information-stealing malware like LummaC2, by pasting malicious commands into the Windows Run dialog.&nbsp;We have discovered an elaborate infrastructure actively used to deliver multiple variants of FakeCaptcha and other malicious content to select users. At the core of the operation is an attacker-controlled Traffic Direction System network. It has a single purpose—to fingerprint the visitor’s device and network details to determine what type of content to deliver. This could be malicious, monetized or decoy content, or no content at all. For reasons we will describe later, we are calling this infrastructure HelloTDS.

As shown in the graphic above, the scope of the campaign is massive; in April and May 2025 alone, we have protected over 4.3 million users worldwide. In terms of absolute numbers, the most affected regions include the United States, Brazil, India, and Western Europe. However, when adjusting for population size and user base, a different trend emerges: the highest relative risk is concentrated in the Balkan countries of Europe and in parts of Africa, particularly Rwanda, Egypt, Tanzania, and Kenya.<h2>Attack Chain</h2>At a high level, the attack works as follows: The victim visits an infected website or clicks on a malicious ad. The entry website requests a JavaScript file from the initial HelloTDS endpoint, which fingerprints the connection and decides whether to serve content or stay idle. If the user is not deemed a suitable victim, the attack stops here. Otherwise, the server responds with a script that further fingerprints the browser, logs mouse movements and similar, eventually sending another request to receive the final payload containing a redirect to the malicious landing page. Among users who passed the initial check, FakeCaptcha was observed to be the most prevalent malicious landing page, with Fake Updates, file downloads containing encrypted malware, tech scams and other fraudulent campaigns also having a share.&nbsp;

One specific example of the full attack chain is illustrated in the next figure: We visited the website dailyuploads[.]net, uploaded an arbitrary image file, and navigated to the link generated by the service. The resulting page included a script from HelloTDS, and when we clicked the download link, we were involuntarily redirected to a FakeCaptcha landing page attempting to trick visitors into executing the Emmenhtal loader.

<h2>From Movie Streaming or File Sharing to Malware</h2>Besides ad networks, the primary source of traffic for HelloTDS are legitimate-looking, properly functioning websites, such as movie streaming sites, torrent mirrors, file-sharing services, link shorteners, or porn websites. However, these websites are specifically crafted or manipulated—presumably also by the attacker—to cooperate with the attacker’s infrastructure and load malicious scripts. This tactic completely bypasses the need for malvertising campaigns through “legitimate” advertising companies, as these websites request the attacker’s scripts directly.Moreover, we have observed a repeating pattern in some of these websites, which offer file sharing services and promise their users financial gains. These include dailyuploads[.]net, streamtape[.]{com,net,to}, watchadsontape[.]com, bigwarp[.]art or savefiles[.]com to name a few. Security or data privacy is clearly not a priority for these services, as anyone can sign up with any e-mail address without verification. We suspect that these websites are cloned from some existing file sharing service and controlled by the same threat actor who controls HelloTDS and eventually delivers FakeCaptcha, for the primary purpose of embedding malicious popups and redirects within the page (although email &amp; password harvesting could be a “welcome” byproduct).

<h2>The Anatomy of a HelloTDS Domain</h2>An “entry point” website, like those described previously, will usually statically embed one or more HTML snippets loading remote JavaScript that look like this:

(In case of file-sharing websites described above, this snippet will be included in the page with the uploaded file, i.e. the one you share the link to, but not on the main page itself.)The source domain is randomly rotated and both path segments are randomly generated (although their length and character sets are always the same), presumably to prevent static detection. Despite this, it is easy to spot these URLs with a human eye (or a clustering algorithm). All the HelloTDS domains we have seen so far have the same format: The apex domain consists of 2-3 (pseudo)words with a “.top”, “.shop” or sometimes “.com” TLD; optionally, a short subdomain is used, consisting of usually 2, but up to 4 random letters.&nbsp;Examples of these domains include:<ul><li>yr[.]unasonoric[.]com</li><li>gq[.]binesyorker[.]com</li><li>sb[.]rowlandpodogyn[.]shop</li><li>nutatedtriol[.]com</li></ul>

Apart from the distinctive domain names, another sign that speaks for HelloTDS is that the domain names are almost exclusively registered in Panama through the Pananames registrar, and the servers reliably present Let’s Encrypt certificates during TLS handshakes.In an attempt to make tracking HelloTDS infrastructure difficult, the authors designed it to be highly dynamic, frequently rotating active domains and their DNS records. Even so, we have identified that all domains associated with this infrastructure are registered under AS7979 (SERVERS-COM) within the following IP ranges:<ul><li>23.83.64.0/22</li><li>23.109.120.0/22</li><li>23.109.128.0/19</li><li>23.109.170.0/24</li><li>94.242.232.0/21</li><li>172.240.104.0/21</li><li>172.241.48.0/21</li><li>172.255.96.0/20</li><li>173.0.146.0/23</li><li>173.237.64.0/20</li><li>188.42.104.0/21</li><li>188.42.240.0/21</li><li>209.192.192.0/18</li><li>212.117.184.0/21&nbsp;</li></ul>

Another interesting aspect shared by all HelloTDS servers is the usage of the non-standard HTTP header “megageocheckolololo”, which we believe is not commonly used by any well-known service. Its presence in the “Access-Control-Allow-Headers” HTTP response header is another indicator of a HelloTDS server.

Lastly, domains belonging to HelloTDS can be reliably identified using the information they expose via “robots.txt”:

The “/hi” endpoint always returns a simple HTML response with a single text node that says “Hello!” — hence the name HelloTDS.<h2> First Stage: Fingerprinting Based on Network Information</h2>The first decision is made by the HelloTDS server immediately upon receiving the request sent from one of the entry point websites. Since we can only send requests and observe the servers’ responses, it is difficult to tell the exact shape of the server’s decision tree. We suspect that several factors, such as IP/geolocation checks, timeouts, or maybe even pure randomness, may contribute to the result in some way.From the user’s point of view, there are two possible outcomes. In one case, the server responds with a no-op script (usually an empty function or a single-line comment containing 2 or 3 letters, like “// ipx” or “// mt”, likely codes used for “debugging” the TDS), meaning the user will not get any malicious content (from that endpoint). Alternatively, the server will respond with a large JavaScript that performs heavy client-side fingerprinting and eventually performs a subsequent request to another HelloTDS endpoint. Either way, the server sets a pair of cookies in the response; these encode information about the client’s browser, operating system and network, as detected by the server, and may be used as a client-side cache for further requests (although we have found that tampering with them is generally not useful).

The cookie values contain Zlib-compressed binary data encoded in Base64. Although the low-level data format is unknown, the data itself contains readable ASCII strings like the client’s IP address, country, or ISP, which reveal the purpose these cookies likely serve.

<h2>Second Stage: Fingerprinting in the Browser</h2>Contrary to the logic executed on the server, the next fingerprinting routine is performed in the browser (by the returned JavaScript) and can thus be reverse-engineered. The exact code returned from different HelloTDS endpoints varies somewhat in structure and complexity (at the very least, the server appends a timestamp comment to hinder hash-based detection), but all of them share the same basic high-level functionality.Crucially, the JavaScript sent by the server contains an encrypted configuration variable — a JSON string where each alphanumeric character is substituted with some other. This part of the code can be easily identified: Look for a function call with two arguments, the first being the encrypted JSON string and the second being the key: A concatenation of the characters a-z, 0-9 and a random permutation thereof. This obfuscation is not unique to HelloTDS; however suspicious it may be for an ad network to employ this technique, we have also observed this behaviour in scripts employed by the Czechia-based Clickadu ad network, which happens to share certain characteristics with the threat actor’s infrastructure.The number of key-value pairs in the configuration object varies, but some common ones we regularly encounter are “url”, “zone_id”, “uuid_url”, “rot_url”, “metric_url”, “timezone_offset” and/or “timezone_diff”. Other keys that particularly stand out due to their names are “devtools_protection” and “philanthropic_level”, which were set to “true” and 0 respectively whenever we inspected a chain that landed on FakeCaptcha in the end.The “*_url” keys contain further HelloTDS URLs, which are used to retrieve a sort of unique identifier (“uuid_url”), the target URL (“rot_url”), an endpoint to report errors and other metrics to (“metric_url”), and an endpoint for mouse movement and device sensors tracking (“url”). Notably, the “rot_url” always contains a special parameter named “md” with a placeholder for the fingerprinting information collected by the script.

The JavaScript collects the following information:<ul><li>Basic browser info: window width and height, document referrer, window location (URL), browser language, current datetime, time zone offset, and whether the site is shown in a top-level window or an iframe,</li><li>the “user id” previously returned by the UUID endpoint,</li><li>whether or not a mobile browser is used (by checking if the deprecated window.orientation property is defined),</li><li>whether or not a touch screen is present (by reporting the value of the window.navigator.maxTouchPoints property),</li><li>page title information, most common words in the host webpage as well as any keywords declared in the host document’s head element,</li><li>the approximate amount of physical memory and the number of processor cores,</li><li>battery status (level, charging state),</li><li>WebGL vendor and renderer,</li><li>a “sandbox score” consisting of 6 flags, e.g., whether the browser is Headless Chrome, or whether specific video codecs are supported,</li><li>network information, e.g., network type (Wi-Fi, Ethernet, cellular, …), effective and maximum bandwidth, or the estimated round-trip time,</li><li>screen orientation and colour depth,</li><li>whether cookies are enabled.</li></ul>

A JSON object containing this information (as well as some keys from the config) is Base64-encoded and sent in the md parameter to the rotated URL from the config via a POST request. The response contains a JSON object with a “url” key as well as a TTL and bidding details.

The returned URL is the last HelloTDS endpoint in the whole chain.<h2>Third Stage: Final Payload with Redirect to Landing Page</h2>The final step in the HelloTDS pipeline is a simple JavaScript-based redirect to the target URL.

In this case, bestfree4u[.]com simply responded with a 301 redirect to a FakeCaptcha landing page at finding-from-internet[.]fly[.]storage[.]tigris[.]dev/seacrh-result[.]html. However, when accessed from a different environment, the same domain may seem harmless. In other cases, the final HelloTDS redirect leads to tech support scams, malicious file downloads, fake browser updates, potentially unwanted browser extensions, or cryptocurrency investment platforms.<h2>The Destination: FakeCaptcha Redirectors</h2>In the past months, we have seen a highly predictable pattern in the malicious URL payloads served by HelloTDS: Almost universally, they were machine-generated domains consisting of a couple of English words and a “.com”, “.shop”, “.online”, “.info”, “.live”, “.pro” or similar TLD, and the URL path was a string with 24 hexadecimal digits, the first two usually being 67 or 68. These URLs served as simple redirects, either to FakeCaptcha, or sometimes to a decoy—usually some (benign but potentially unwanted) browser extension or cryptocurrency product website. We have seen multiple of these URLs redirect to both a FakeCaptcha landing page and a decoy at different times, which removes any doubt about this being an inherently malicious service. Example URLs include the following:<ul><li>actednow[.]com/675cb495c39bc481ddf8edd6,</li><li>buzzflying[.]shop/6767af2ee2aa535e92d62a64,</li><li>goldtera[.]live/6758b1d6467532a801fa06c4,</li><li>orbito[.]online/677120fb2cca41d88a7392a2.</li></ul>The domains used by this service could be reliably identified by being registered under Namecheap in Reykjavik, Iceland, using a Let’s Encrypt TLS certificate, and resolving to one of the following IP addresses:<ul><li>5.161.37.228,</li><li>5.161.110.119,</li><li>5.161.178.111,</li><li>23.105.163.27,</li><li>23.105.163.55,</li><li>34.142.174.238,</li><li>172.104.80.249.</li></ul>Recently, the attacker has started employing more sophisticated masking even at the level of the final payload.Additionally, the structure of served URLs redirecting to FakeCaptcha has changed – they now often include parameters with placeholders, which may not even be filled in, yet the victim can still be redirected to a FakeCaptcha landing page. We have seen different variations of these URLs, some of which omit specific parameters.

Interestingly, some of the URLs served by HelloTDS redirect victims to FakeCaptcha landing pages, but when accessed in a controlled environment, they often mimic some legitimate websites and serve some benign content. One example of such a website is&nbsp;hxxps[://]avs4u[.]net/?sub1=39388&amp;sub2=…&amp;sub3=ID&amp;sub4=677886&amp;sub5=0.0004752 — while it often redirects the victims to FakeCaptcha landing pages, it may also display mimicked content of the legitimate website www.avs4you.com, a software for processing videos and images. The downloadable binary is also legitimate, indicating an attempt to conceal malicious activity.Another example of a URL redirecting victims to FakeCaptcha but serving legitimate content in a controlled environment is hxxps[://]arcadeclassic[.]org/?sub1=681978&amp;sub2=0.00037565.&nbsp;

We therefore tried to understand the reasoning behind the decision of whether malicious content is served. As part of this effort, we explored the potential influence of the cookies being set, which we mentioned earlier. Ultimately, we have concluded that the decision is probably based solely on the IP address of the client. We suspect that if the IP address originates from a known VPN or other anonymizing services, the victim is consistently redirected to some benign content, likely because such users are not target victims and may potentially be security analysts. In such cases, HelloTDS delivers benign content to obscure its actual behavior, effectively evading analysis and avoiding detection.<h2>Delivered Malicious Content</h2>In our analysis of HelloTDS landing page redirectors, we observed that they serve a mix of both malicious and legitimate content. These “clean” redirects, however, often lead to investment-related sites, especially those involving cryptocurrencies. We believe that this choice is deliberate. Firstly, generating traffic to advertisers through non-consensual clickjacking may serve as an alternative, more predictable source of income for the attacker without “stepping into the dark” and serving hard malware. Furthermore, if the primary objective of FakeCaptcha is to infect victims with information stealers that ubiquitously target crypto wallets, redirecting users who were not deemed as ideal victims to a crypto investment platform may be the most logical strategy for the attacker in the long run.On the unequivocally malicious side, various forms of FakeCaptcha were predominant, but we have also encountered Fake Updates, tech scams, download links with encrypted archives delivering LummaC2, and various other scams. Some specific examples are listed below.

<h2>Key Takeaways and Defensive Measures</h2>The HelloTDS infrastructure behind FakeCaptcha campaigns demonstrates how attackers continue to refine their methods to bypass traditional protections, evade detection, and selectively target victims. By leveraging sophisticated fingerprinting, dynamic domain infrastructure, and deception tactics (such as mimicking legitimate websites and serving benign content to researchers) these campaigns achieve both stealth and scale.What You Can Do:<ul><li>Use reputable security software with real-time protection to block known TDS and FakeCaptcha domains. Products from Norton, Avast, AVG, and Avira automatically protect users against these threats.</li><li>Enable browser-level protections like anti-tracking and ad-blocking extensions, which may prevent the initial malicious scripts from loading.</li><li>Be cautious with file-sharing and streaming sites, especially those that promise monetary rewards or allow anonymous uploads without verification.</li><li>Avoid copying and pasting commands from unknown or suspicious websites into system dialogs like Windows Run.</li><li>Inspect suspicious domains manually or through security tools—look for signs like oddly-structured URLs, frequent domain rotation, or generic domain names.</li></ul>FakeCaptcha is not just a social engineering trick. It's the final step in a well-orchestrated system that filters, evaluates, and targets users with precision. Understanding the infrastructure—HelloTDS in this case—is key to disrupting the full chain of attack.<h2>Indicators of Compromise (non-exhaustive)</h2>You can find the complete list of IoCs on our <a href="https://github.com/avast/ioc/tree/master/HelloTDS">GitHub</a>.<h3>File Sharing Entry Websites</h3>dailyuploads[.]netstreamtape[.]tostreamtape[.]netstreamtape[.]towatchadsontape[.]combigwarp[.]artsavefiles[.]com<h3>HelloTDS Domains</h3>yr[.]unasonoric[.]comgq[.]binesyorker[.]comsb[.]rowlandpodogyn[.]shopnutatedtriol[.]commixscoggan[.]shopbu[.]unrimedironize[.]shop<h3>FakeCaptcha Redirectors</h3>actednow[.]com/675cb495c39bc481ddf8edd6buzzflying[.]shop/6767af2ee2aa535e92d62a64goldtera[.]live/6758b1d6467532a801fa06c4orbito[.]online/677120fb2cca41d88a7392a2bestfree4u[.]comavs4u[.]net/arcadeclassic[.]org<h3>FakeCaptcha Landing Pages</h3>adelaidavizcaino[.]com/cpwpartage-de-medias[.]fly[.]storage[.]tigris[.]dev/affiliate-link[.]htmlfinding-from-internet[.]fly[.]storage[.]tigris[.]dev/seacrh-result[.]html

A behind-the-scenes look at HelloTDS: the stealthy infrastructure driving FakeCaptcha scams, malware and more across millions of devices

Say Hi to HelloTDS: The Infrastructure Behind FakeCaptcha 

Threat Operations Analyst at Gen

A new wave of charity scams is targeting Brazilians through social media. Scammers are repurposing people’s real-life struggles to create fake charity websites with the intent to steal money from individual charity donors. Victims of this scam may not even be aware that their donation has not reached its intended recipient.&nbsp;The scam starts on social media such as Facebook, Threads and Instagram. Scammers use fake profiles or hacked accounts to join fundraising groups and groups dedicated to local towns. They often repost several posts from other accounts to gain legitimacy, followed by posting links to a prepared fake donation website.&nbsp;

Once the victim with charitable intentions clicks on the link, they are presented with a fake copy of a known fundraising website, often Vakinha. The scammers mostly copy real stories posted by people in need to scam money away from donors. The websites sometimes contain links to YouTube videos posted by the original profiles on the real website.&nbsp;&nbsp;

The websites feature a fake Facebook feed with incoming comments from people who have supposedly donated to the cause. There is also an incoming donation effect that tries to lend legitimacy to the scam, making the victim believe that other people are actively donating.&nbsp;If the victim decides to donate, they are redirected to a payment page with a PIX code and QR code. PIX is a real-time instant payment system in Brazil, created by the Central Bank of Brazil. The payment page often contains further encouragements and a how-to-donate manual. Unlike with phishing and other types of cyberattacks, the scammers are not going after victim’s details, they just syphon away money from legitimate charitable causes.&nbsp;

If the victim sends away the payment, the website displays a thank you page, attempting to convince the victim that the money sent has been received by the cause. It is likely that victims may never know they have sent money away to scammers. The other victims, the people in actual need of assistance, never receive the money.&nbsp;

Avast blocks this new scam and has protected hundreds of users in Brazil in the last week. If you encounter a similar donation scam, please consider the following:&nbsp;<ol><li>Use reputable websites that verify profiles and charity cases. This way you can avoid falling for a scam or sending money to scammers instead of the intended cause. </li><li>Beware of fake links spread through social media. Verify the URL you are clicking on and check that the website is the one you are intending to donate through. </li><li>Research the organization. If you see a post asking for donations with a link to a website, do a quick Google search to ensure its legitimate. </li><li>Avoid pressure tactics. Scammers often create a sense of urgency to keep their victim engaged. Be wary of sending money away if you are feeling pressured.&nbsp;</li></ol>

Scammers are faking charity sites to steal donations. Here's how to spot them before it's too late. 

False Hope: Scammers Exploit Brazil’s Kindness in Latest Charity Scam

Principal Data Scientist at Gen

Over the past few months, dozens of ads have flooded Czech Facebook feeds, promising clearance sales from small boutiques, often accompanied by a&nbsp;heartfelt story about a store closing down and bidding farewell to loyal customers. At first glance, these ads look like genuine local sales. But a closer look reveals a sophisticated scam campaign, often powered by AI-generated images and spread through hundreds of variations.&nbsp;In this article, we’ll dive into one such campaign running under the name “Jana Praha” to uncover why it’s so dangerous and how to recognize it before you fall victim.&nbsp;<h2>How the Scam Works&nbsp;</h2>Imagine scrolling through Facebook and seeing an ad from what appears to be a small fashion brand. The message is emotional and believable:&nbsp;“It is with great sadness that I must announce something very difficult. After many years of love and dedication to my boutique Jana Praha, the time has unfortunately come to say goodbye. As a small business, I’ve always struggled against the big chains, which are increasingly dominating the market thanks to their huge budgets and influence. Sadly, it’s no longer financially sustainable for me. The world is changing—and I just can’t keep up…”&nbsp;The story sounds authentic, the name Jana is familiar and the photo shows a woman standing outside a boutique storefront. But here’s the catch—the woman isn’t real. These images are AI-generated, changing subtly across different ads and the storefronts don’t exist in reality.&nbsp;No real map locations, no customer reviews, no store history. The contact information listed in the terms shows a suspicious business registration and address unrelated to the Czech Republic:&nbsp;<ul><li>Business name: Riet E-com&nbsp;</li><li>Company ID: 95561110&nbsp;</li><li>VAT ID: NL005161660B82&nbsp;</li><li>Customer support email: <a href="mailto:podpora@jana-praha.cz" target="_blank" rel="noreferrer noopener">podpora@jana-praha.cz</a>&nbsp;</li><li>Business address: Tessenvijverstraat 3, 4885BC Achtmaal (in the Netherlands)&nbsp;</li></ul><h2>The Facebook Pages Behind the Scam&nbsp;</h2>This fake e-shop is promoted through multiple Facebook pages—like <a href="https://www.facebook.com/ads/library/?active_status=all&amp;ad_type=all&amp;country=CZ&amp;is_targeted_country=false&amp;media_type=all&amp;search_type=page&amp;view_all_page_id=613481905182526" target="_blank" rel="noreferrer noopener">Jana Praha Boutique</a>, <a href="https://facebook.com/61574563287873" target="_blank" rel="noreferrer noopener">Jana Praha Fashion</a> and <a href="https://www.facebook.com/ads/library/?active_status=all&amp;ad_type=all&amp;country=CZ&amp;is_targeted_country=false&amp;media_type=all&amp;search_type=page&amp;view_all_page_id=631552540034282" target="_blank" rel="noreferrer noopener">Jana Praha</a>—all of which share one thing in common: they have no organic posts, only thousands of ads.&nbsp;Clicking the ads redirects people to a fake Shopify-based online store translated into Czech. Enter your payment details here, and you risk losing money, immediately or later through unauthorized use.

<h2>How Many Ads Are There?&nbsp;</h2>Meta’s Ad Library reveals hundreds of campaigns running simultaneously. One page might have hundreds of active ads at once, each with slight variations in images and text. In total, thousands of ad versions rotate continuously to flood Facebook and avoid detection.Each ad targets a limited audience for a short time to prevent negative comments from accumulating and warning others.<h2>Why the Scam Works&nbsp;</h2>Several psychological and technical tricks make this scam effective:&nbsp;<ul><li>Emotional storytelling: Stories of family struggles, “doing it for the kids,” and thanking loyal customers&nbsp;</li><li>Urgency: Phrases like “final clearance” and “last pieces” pressure people to act fast&nbsp;</li><li>Familiarity: Common Czech names like Jana, Petra and Martina boost trust&nbsp;</li><li>AI visuals: Photos look real enough but are difficult to verify&nbsp;</li><li>User behavior: Most people don’t check if the store actually exists or if photos are genuine&nbsp;</li></ul><h2>What Was Suspicious About This E-Shop?&nbsp;</h2>The photos were almost too perfect. &nbsp;Models with flawless smiles, pristine dresses and clean backgrounds, but with inconsistencies in storefront signage and surroundings.&nbsp;The boutique’s “closing” story clashed with an always-stocked e-shop boasting “new arrivals” in every size. Promises like “Ships today if you order by 11 PM” are unrealistic for a small local store.&nbsp;Package tracking was offered, but the tracking page’s browser tab read “Vlog de bestelstatus - Juno mode”, a sign the site was hastily copied from a foreign template.&nbsp;No legitimate contact info or store address, only an email that went unanswered. The terms listed a Dutch business address, further increasing suspicion.&nbsp;Customer reviews appeared as simple quotes on the site, with no independent verification. Claiming “4,500 satisfied customers” seemed inflated for a supposed small boutique.&nbsp;A WHOIS lookup showed the domain was registered just in March 2025, contradicting the brand’s claim of a long tradition.&nbsp;

A quick Google search found no trustworthy references to the store, only a Facebook post from the real owner of a similarly named boutique warning about stolen photos and brand identity misuse.&nbsp;<h2>What Can You Do to Protect Yourself?</h2><ul><li>Don’t click on emotional ads promising unbelievable deals without verifying the source.&nbsp;</li><li>Check for real social media posts, trusted reviews and a website history.&nbsp;</li><li>Be wary of strange domain names and photos that seem too perfect.&nbsp;</li><li>Report suspicious ads to Facebook to help protect others.&nbsp;</li></ul>The “Jana Praha Fashion” case shows how easily the public can be manipulated with a mix of AI, emotional storytelling, and targeted advertising. Scam campaigns aren’t spreading through phishing emails or SMS anymore—they’re coming directly through ad systems that have massive reach and user trust.&nbsp;To protect yourself, stay vigilant. If you come across something suspicious, report the ad. And if this topic concerns you—it’s time we start talking about it more publicly.&nbsp;

Inside the AI-powered farewell sale scam targeting Czech Facebook users and tips to recognize it.

What a Scam Ad Campaign for a Fake Online Store on Facebook Looks Like in 2025: The Case of “Jana Praha”

You’re not just carrying a phone anymore, you’re carrying your identity, your memories, your finances, your secrets. And that’s exactly what cybercriminals are after.&nbsp;In recent months, mobile threats haven’t just grown. They’ve gotten personal. From intrusive adware hijacking your screen time to spyware designed to blackmail, monitor or steal your crypto keys, and banking trojans that steal your NFC tokens to be used for money withdrawals at ATMs, attackers are escalating their tactics to target the people behind the devices.&nbsp;Adware once felt like a nuisance. Now, it’s hard to ignore. Attacks rose by 18% in Q1, led by threats like HiddenAds and MobiDash. MobiDash alone jumped 90%, disguising itself, hiding its icon and overwhelming screens with intrusive ads. It’s turning everyday devices into distraction engines.&nbsp;

These aren’t isolated incidents. Users in Brazil, India, Argentina, Mexico and Turkey were hit hardest, with risk ratios rising sharply. Adware’s persistence is less about innovation and more about sheer volume and its impact is felt every time someone’s screen is hijacked by something they never asked for.&nbsp;While adware dominated in volume, spyware showed the most disturbing evolution. Our telemetry shows a 7% overall increase in mobile spyware detections, but the true story is in where and how it’s spreading.&nbsp;In Brazil, Spain and Turkey, spyware detections jumped by more than 80%. SpyMax is the primary driver, often hidden in repackaged apps and games. In some cases, it even snuck onto the Play Store. But that was only the beginning.&nbsp;But these were eclipsed by the emergence of SparkCat, a spyware strain that may mark a turning point in mobile security. Disguised as AI tools and food delivery apps, SparkCat managed to slip into both the Google Play Store and Apple App Store, an extremely rare feat.&nbsp;

Initially benign, the apps later pushed an update containing a stealthy SDK. Once activated, it used optical character recognition (OCR) to scan the screen for crypto wallet recovery phrases, effectively turning mobile screens into leak points for financial keys.&nbsp;The most alarming part? Evidence suggests SparkCat’s creators compromised the supply chains of legitimate developers to inject their code, without the developers’ knowledge. SparkCat is likely the first true infostealer to operate within the App Store — a milestone we hoped never to reach.&nbsp;Even more harrowing is the rise of SpyLend, a new variant of the notorious SpyLoans spyware family. Popular in India, it masquerades as a finance calculator on the Play Store. But once installed, it redirects users to an off-platform APK download, bypassing Play Store protections entirely.&nbsp;

From there, the app harvests everything: SMS, call logs, documents, photos and even clipboard content, exposing credit card numbers and passwords. But this isn’t just about data. It’s about control.&nbsp;Some mobile threats are crossing new lines — misusing personal content and blurring the boundary between digital risk and real-life impact. In rare cases, we’ve seen manipulative tactics like fake images used to pressure or intimidate victims. These threats remind us why strong mobile protections and digital confidence matter more than ever.&nbsp;At the same time, a shift is underway: some banking trojans now rely on social engineering over technical trickery. Instead of breaking in, they convince users to open the door. It’s a clear signal that awareness and smart defenses are just as critical as detection.&nbsp;

In the ever-evolving mobile banking malware ecosystem, Crocodilus emerges as the novel threat active in Spain and Turkey. Pushing the limits of device control, it abuses accessibility permissions to display fake banking apps overlays and keylogs every input. Not only that, it tricks victims into accessing their crypto wallets, stealing recovery phrases through screen monitoring. It’s part of a disturbing trend: malware that doesn’t just steal, but makes you unwittingly help it do so.&nbsp;&nbsp;

NGate, a pioneer of stealing NFC tokens from victims, strikes again. Victims are faced with a believable copy of their bank’s website, distributed through fake money withdrawal SMS alerts. Once NGate initiates its NFC theft, threat actors must get physically involved to withdraw money from ATMs in the respective country.

Unfortunately, victims have already helped the threat actors by providing their PIN during the infection process, allowing them to proceed with the transaction. Previously targeted at Czech Republic, Slovakia and Hungary, our telemetry shows new variants popping up in Russia and Poland, disguised as government portals and bank apps.&nbsp;These mobile threats reveal a clear trend: attackers are investing in more personal, persistent and creative ways to reach users. From adware that blurs the line between annoyance and abuse, to spyware capable of bypassing official app store protections, the threat landscape is evolving in both scale and sophistication.&nbsp;&nbsp;What’s changing isn’t just the threat — it’s how it works. Attackers are tapping into trust, using familiar apps, clever tactics and even legitimate supply chains to get closer to people, not just devices. As mobile becomes the hub of our digital lives, understanding these shifts is just as important as spotting them.&nbsp;These threats aren’t just technical—they’re personal. They blend into daily routines, using design and deception to stay one step ahead. That’s why staying informed is powerful. It helps you see what’s coming and respond with clarity.&nbsp;Knowledge is step one. Protection is the difference-maker. The right mobile security tools don’t just detect threats — they anticipate them, block them and help you move forward with confidence. Because digital freedom means knowing you’re covered, no matter how threats evolve.&nbsp;

Mobile threats are getting personal — and more dangerous. Here’s what Gen researchers uncovered in Q1. 

When Mobile Threats Turn Personal 

Senior Malware Researcher

Cybercriminals continue to refine their methods, and our latest discovery ties together multiple advanced attack techniques into a single campaign which demonstrates the latest trend in “Scam-Yourself” attacks. This particular campaign utilizes fully AI-generated videos created using deepfake principles and AI-generated scripts, created with ChatGPT and hosted on Pasteco and other script sharing websites. In our&nbsp;<a href="https://www.gendigital.com/blog/insights/reports/threat-report-q3-2024">Q3/2024 Threat Report</a>, we reported a 614% surge from “Scam-Yourself” attacks, those which&nbsp;manipulate people into voluntarily downloading malware or compromising their own security. Shortly after, we announced our&nbsp;<a href="https://www.gendigital.com/blog/news/family-of-brands/clipboard-protection">Clipboard Protection</a> feature, adding an extra security layer against these attacks. In a matter of days, we uncovered&nbsp;<a href="https://www.gendigital.com/blog/insights/research/cybercriminals-leveraging-chatgpt-to-create-malicious-payloads">cybercriminals actively leveraging ChatGPT to create and refine malicious payloads</a>. This article sheds light on the latest evolution of these tactics.What makes this discovery even more significant is the revelation that the campaign originates from a well-crafted video hosted on a verified YouTube channel with 110,000 subscribers. The channel appears to have been either compromised or acquired, and the video has already amassed +24,000 views. Additionally, numerous YouTube accounts, all variations of the same AI-generated profile, have been used to amplify the scheme, accumulating hundreds of thousands of subscribers.

<h2>The Dangerous Convergence of Threats</h2>This campaign connects multiple security challenges:<ul><li>Compromised accounts: The attack likely started with data theft using information stealers, allowing cybercriminals to take control of a verified YouTube channel and repurpose it for their scam operations. The channel, at first glance, appears legitimate as it includes a list of videos from the official TradingView channel, making it seem trustworthy. However, it also contains an unlisted deepfake video, which can be shared externally. This deception makes it difficult for victims to identify the fraud when viewing the channel. Furthermore, numerous fake accounts have been created, misusing this person as the “face” of multiple fraudulent channels. These fake YouTube accounts using the AI persona of Thomas Harris / Thomas Roberts have hundreds of thousands of subscribers. Many appear to be taken over or bought-off old accounts, some dating back to 2011. These accounts are continuously being taken down. Additionally, the engagement on these channels is manipulated, with all positive comments typically being 'bought' and added in bulk within a short period. Some of the observed fake accounts include @ThomasHarris-Iives, @thomas_hrris_a, @Thomas_View, @Thomas_Harris_Us, @ThomasRoberts_crypto, @tiommewweb3, @Thomas_Now, @RudoAMIN, and @UC6QvVs237am4RyYo1vGHF3g.</li></ul>

<ul><li>Deceptive tutorial video: The video presents itself as a tutorial to unlock TradingView’s developer mode, claiming that doing so will provide AI-powered indicators to help users grow their portfolio by a significant percentage. This lure is designed to appeal to individuals looking for an easy way to maximize their financial gains, making them more susceptible to following the video's malicious instructions.</li></ul>

<ul><li>Deepfake technology: The video appears to depict a completely AI-generated person, with no identifiable real-world counterpart. It utilizes techniques similar to those used in deepfake creation, combining voice, facial synthesis, and body movement replication to create a highly convincing impersonation. Furthermore, we’ve observed more AI-generated videos used across the fake profiles, suggesting attackers are re-creating multiple versions of this well-crafted content.</li><li>AI-generated malicious scripts: The script used in the attack was created with AI, in this particular case with ChatGPT. The script itself remains largely unchanged across different variations of the campaign, with the only significant difference being the Command-and-Control (C&amp;C) address. Attackers modify the C&amp;C domain as previous ones are flagged or blocked, demonstrating an adaptive approach to evade detections.</li><li>Scam-Yourself trend: The video demonstrates the same tactics seen in past attacks, instructing users to manually execute harmful commands (e.g., pressing Win+R and entering specific code).</li><li>Hosting services: Attackers have shifted from pasteco[.]com to equivalent sites such as 0bin[.]net or pastefy[.]com, and likely attacker-controlled domains such as pasteco[.]net and pasteco[.]io, a strategy designed in an attempt to evade detection.</li><li>Remote access and data theft: The end goal of this campaign is to install NetSupport or Lumma Stealer, granting attackers full control over the infected system and enabling data exfiltration. Cryptocurrency serves merely as a lure to attract an audience motivated by easy profit.&nbsp;</li></ul><h2>Malvertising as the origin</h2>Especially when we consider that some of the videos are unlisted and on verified accounts, one might ask how the user comes across such a video in the first place. What we can see is quite a big promotion via Sponsored advertising on YouTube, allowing the videos to pop-up while watching other videos with similar type of content, for example cryptocurrency related investments or other financial opportunities.

In this case, the account was named Oscar Davies, leading to slightly different variant of the AI generated video. This indicates that the attackers don’t hesitate to re-generate the original video to refresh the content and stay undetected for a longer period of time. When following the advertisement, the video is, in this case, also verified with the checkmark. We can see that the account has nearly half a million subscribers, with the video having 12 thousand views and the time of the analysis. Interestingly, these numbers do not match with the advertised views.

We observed multiple different thumbnails and video titles for the advertised videos, too, likely provided by additional AI driven image generation.

<h2>How We Are Protecting Users</h2>Our security solutions detect and block this threat. Our&nbsp;<a href="https://www.gendigital.com/blog/news/family-of-brands/clipboard-protection">Clipboard Protection</a> feature, designed to prevent clipboard-based scams, is particularly relevant in mitigating such attacks. This campaign reinforces the growing importance of proactive security measures against evolving social engineering threats.We remain committed to tracking these threats and investigating similar campaigns as they evolve. With deepfakes, AI-generated malware, and social engineering tactics advancing rapidly, proactive security measures are more crucial than ever. Given the involvement of a major player in this space, Lumma Stealer, it is likely that we will see even more campaigns following a similar model. This trend could lead to the creation of even more sophisticated AI-generated personas, making it increasingly difficult to distinguish real from fake. As cybercriminals refine their techniques, vigilance and robust security measures will be essential in combating these evolving threats. Stay safe and always verify sources before executing any online instructions.<h2>Indicators of Compromise (IoCs)</h2>902387e7be025fbe2c4b1a3f2ea212a26f9cbbcf82f656416b362c84089b712b (PowerShell commandline)a5e0635363bbb5d22d5ffc32d9738665942abdd89d2e6bd1784d6a60ac521797 (PowerShell script)developer-update[.]dev (C&amp;C)1b5b3e104f80e09f006a1080fefae16fed2dbf1abb697e464cbef3f2fabc5d90 (PowerShell commandline)begenokev[.]com/oauth/harum/voluptas (C&amp;C)2fe60aa1db2cf7a1dc2b3629b4bbc843c703146f212e7495f4dc7745b3c5c59e (Lumma Stealer)developerbeta[.]dev (C&amp;C)b89aa5a2837aa09d0caae2bc5be130186f236471411b279049dd1cfce6a5643f (PowerShell commandline)bcbb6de248a95bfdbf4cfe8db8d84f8a10db2896f27cb90058c69b7bb052d506 (PowerShell script)

Inside the Evolution of AI-Powered Scam Tactics

How AI-Generated Personas, Deepfake Tactics and Scripts Are Powering the Next Wave of"Scam-Yourself" Attacks

Threat Analysis Engineer at Gen

Imagine receiving a message on LinkedIn from a recruiter offering an enticing opportunity: a well-paid front-end development project that seems almost too good to be true. It’s a scenario many aspiring programmers dream of, especially those eager to land their first job in the tech industry. However, as this story reveals, the dream can quickly turn into a cybersecurity nightmare.&nbsp;<h2>The Setup&nbsp;</h2>The attack begins innocuously enough. A recruiter reaches out on LinkedIn, pitching an appealing development project with an impressive salary. The target? Entry-level front-end developers, often beginners in the field and eager to seize opportunities. Once the victim expresses interest, the recruiter provides a link to a code repository, ostensibly containing the project files.&nbsp;In one known case, the recruiter’s high salary offer raised suspicions. This wariness led the targeted individual to scrutinize the repository, revealing malware embedded within the code. The victim wisely decided against proceeding, avoiding infection entirely. Shortly thereafter, the recruiter’s LinkedIn profile disappeared, leaving questions about their next steps unanswered.&nbsp;<h2>A Firsthand Example&nbsp;</h2>This story came to light when we became aware of a similar job offer on LinkedIn. The recruiter claimed to be developing a decentralized application (DApp) for purchasing and claiming ownership of video games using NFTs. The project aimed to provide a seamless cross-platform experience and was allegedly seeking skilled web developers to help with their UI/UX redesign.&nbsp;

After a few messages, the recruiter shared a Bitbucket repository link. At first glance, the project appeared legitimate, with standard documentation and architecture diagrams detailing the NFT-based system. However, deeper investigation revealed a suspicious obfuscated JavaScript file, onfig-overrides.js, containing malicious code. This file, overlooked by an untrained eye, was designed to:&nbsp;<ul><li>Steal login credentials</li><li>Exfiltrate crypto wallet data</li><li>Deploy and execute a Python loader&nbsp;</li></ul>The recruiter’s polished approach and seemingly genuine project made the scam particularly deceptive.&nbsp;

<h2>The Mechanism&nbsp;</h2>The attack exploits standard industry practices. In many coding interviews or preparation tasks, candidates are asked to clone a repository, run a local server, and work on the application offline. This is commonplace for front-end developers testing web applications. However, in this case, the repository included concealed malware designed to compromise the developer’s system.&nbsp;<h2>The Step-by-Step Anatomy of the Attack&nbsp;</h2>Once executed, the obfuscated JavaScript file initiated a multi-stage attack process, consisting of two main phases: the initial JavaScript execution and the subsequent Python-based payloads.&nbsp;Phase 1: JavaScript Execution&nbsp;<ol><li>Information Stealing: The initial script acted as an infostealer, targeting:</li></ol><ul><li>Solana wallet configurations and stored crypto wallet data.</li><li>Login credentials stored in web browsers such as Firefox and Chrome.</li><li>Other sensitive information that could be used for further attacks.</li></ul><ol start="2"><li>Python Loader Deployment: The JavaScript file downloaded and executed a Python-based loader, which was responsible for delivering the next set of malicious payloads.&nbsp;</li></ol>Phase 2: Python-Based Payloads&nbsp;<ol start="3"><li>Remote Access Trojan (RAT): The Python loader executed a RAT with keylogging and advanced spying capabilities, including:</li></ol><ul><li>Remote shell commands: Enabling attackers to execute commands on the victim’s machine.</li><li>Clipboard exfiltration: Capturing and transmitting clipboard data to the attacker.</li><li>Payload downloads: Downloading and executing additional malicious files.</li><li>Browser process termination: Killing Chrome and Brave browser processes to disrupt user activity.</li><li>Sensitive file exfiltration: Searching for and exfiltrating critical files such as .env, readme, and .git.</li></ul><ol start="4"><li>XMRig Cryptominer: As part of the second Python stage, the XMRig cryptominer was deployed, exploiting the victim’s computing resources to mine cryptocurrency, which resulted in degraded system performance and increased power consumption.&nbsp;</li></ol>This structured attack exemplifies the multi-layered and highly intrusive nature of this attack, ilustrating how it moves beyond simple credential theft to fully compromising the victim’s machine.&nbsp;<h2>The Lazarus Group Connection?&nbsp;</h2>Interestingly, the tools used in this attack, named "BeaverTail" and "InvisibleFerret," have been attributed to the notorious Lazarus group in the past. We have strong indications that the attack was orchestrated by the Lazarus group, given their history of sophisticated cyber campaigns and their association with the tools used. The attackers leveraged tools previously linked to high-profile cybercrime, making it critical to approach such situations with caution. While the involvement of Lazarus cannot be confirmed with absolute certainty, the evidence strongly suggests their involvement.&nbsp;<h2>The Broader Implications&nbsp;</h2>While this specific attack focused on credential theft and cryptojacking, the Remote Access Trojan (RAT) also allows attackers to maintain long-term control over infected systems. This could be used for espionage, further malware deployment, or data exfiltration. Additionally, the potential harm could extend far beyond. The perpetrators could use such schemes to:&nbsp;<ul><li>Compromise company systems through stolen credentials, allowing further infiltration and unauthorized access.</li><li>Utilize the compromised system for ransomware deployment or additional malware infections.</li><li>Leverage the infected machine as a launching point for future cyberattacks, amplifying the scope of the breach.&nbsp;</li></ul>The idea of attackers genuinely hiring developers to create malicious tools is not far-fetched, though it seems unlikely in this instance.&nbsp;<h2>Lessons for Job Seekers&nbsp;</h2>This incident serves as a crucial reminder for job seekers, particularly those new to the field, to exercise vigilance when assessing job offers. Here are some tips to protect yourself:&nbsp;<ol><li>Have an online interview before proceeding: Before starting any test or downloading files, request a video call with the recruiter to verify their legitimacy and discuss the job offer in detail.</li><li>Verify the recruiter’s credentials: Cross-check their profile and company information. If something seems off, trust your instincts.</li><li>Scrutinize repositories: Before cloning or running any code, scan the files for anomalies. Use reputable security tools to analyze suspicious files.</li><li>Question too-good-to-be-true offers: Unrealistically high salaries or overly eager recruiters can be red flags.</li><li>Use sandbox environments: Run unfamiliar code in isolated environments to prevent potential infections.</li><li>Stay informed: Keep up with the latest cybersecurity threats to recognize warning signs early.&nbsp;</li></ol><h2>Conclusion&nbsp;</h2>Threat actors are increasingly targeting individuals with highly personalized and sophisticated methods, exploiting both technical vulnerabilities and human psychology. This case serves as a sobering reminder of the lengths cybercriminals will go to exploit human trust and technological processes. For aspiring developers and job seekers, awareness and skepticism are critical defenses. As we face increasingly sophisticated threats, a collective effort to educate and inform will play a crucial role in minimizing risks. By staying vigilant, leveraging security tools, and promoting best practices, we can create a safer digital landscape for everyone—one where opportunities are genuine, and trust is protected.&nbsp;

Beware of Fake Job Offers: How Hackers Are Targeting Developers with Malware

How Cybercriminals Are Turning Job Offers Into Malware Traps 

<h2>Clipboard Protection Reveals ChatGPT’s Role in Malware Attacks&nbsp;&nbsp;</h2>Attackers are constantly seeking innovative ways to deliver malicious payloads – harmful malware components. Our Norton, Avast and AVG brands recently launched Clipboard Protection, and the feature has uncovered an intriguing new development. &nbsp;Through Clipboard Protection, which analyzes content copied from websites in Firefox and Chrome, we identified a sophisticated attack chain involving a Remote Access Trojan (RAT) known as NetSupport RAT. This discovery highlights how attackers are exploiting AI tools like ChatGPT to create and iteratively improve malicious scripts, further enhancing their effectiveness.&nbsp;<h2>From AI to Malware: The ChatGPT Connection&nbsp;</h2>In a recent investigation, we discovered the development process of a malicious script in three distinct stages. The first two iterations were clearly drafts obtained from ChatGPT. AI-generated content’s ability to rapidly generate, adjust and polish technical scripts makes it a double-edged sword. While tools like ChatGPT offer benefits for applications, they also enable malicious actors to streamline the development of harmful payloads.The final version of the script, a polished malicious script, was later copied by unsuspecting users from legitimate content-sharing websites. The script poses as a prompt to "Enable dev-mode for TradingView," urging users to run terminal commands that ultimately install malware on their systems. This tactic leverages the trust and interest in popular platforms like TradingView to manipulate users into unwittingly executing harmful code.&nbsp;<h2>The Stage of the Malicious Script&nbsp;</h2>By analyzing the clipboard data, we were able to trace the evolution of the malicious script:&nbsp;<ol><li>Initial Drafts: Generated via ChatGPT, providing a basic framework for the attack.&nbsp;</li><li>Refinement: Adjustments made by the attackers to improve the script’s functionality and conceal malicious intent.&nbsp;</li><li>Final Version: A seamless, deceptive script disseminated on legitimate platforms, primed for unsuspecting users to execute.&nbsp;</li></ol>

Clipboard Protection’s ability to track these stages showcases the role of real-time analysis in identifying and reducing emerging threats.&nbsp;<h2>Clipboard Protection: A Game Changer&nbsp;</h2>This discovery underscores the importance of proactive features like our in an ever-evolving threat landscape. Cybercriminals are continuously adapting, finding new ways to bypass defenses and deliver their malicious payloads. Our Clipboard Protection feature was designed to analyze content copied from websites in real time, alerting users to potential threats like <a href="https://us.norton.com/blog/emerging-threats/threat-report-q3-2024" target="_blank" rel="noreferrer noopener">ClickFix and FakeCaptcha</a> attacks. By staying ahead of attackers with innovative solutions like this, we not only detect and prevent attacks but also gather valuable insights into emerging tactics, enabling us to anticipate and counter new threats effectively.&nbsp;As cybercriminals continue to adapt their tactics, relying on sophisticated tools like AI to refine and distribute malicious payloads, solutions like Clipboard Protection play a pivotal role in staying ahead of these threats. Tracking the evolution of attacks and intercepting them before they can cause harm can ensure protection for users and systems in this complex digital landscape.&nbsp;&nbsp;<h2>Indicators of Compromise (IoCs)&nbsp;</h2>SHA256&nbsp;46114741a409cdc05b10152cd469dd724dd44e1e61155ab47de26799c96d298f&nbsp;25dbd7505d600dbe024f5491a61c9a1ee16b81c151f7e8fd633d7144fe045106&nbsp;cd341e404f40bd826e4e3b5a60db28161a70a29a9fb360c74884c6254b0031a8&nbsp;URL&nbsp;https://pasteco[.]com/t2yc80yb&nbsp;

How ChatGPT Is Aiding Cybercriminals in Crafting Advanced Malware Scripts

Cybercriminals Actively Leveraging ChatGPT To Create And Refine Malicious Payloads

<h2>Key points:&nbsp;</h2><ul><li>Glove Stealer is an information stealer written in .NET, stealing sensitive data from wide range of browser extensions as well as locally installed software&nbsp;</li><li>It focuses on browser data (cookies, autofill, …), cryptocurrency wallets, 2FA authenticators, password managers, email clients, and more&nbsp;</li><li>Glove Stealer uses a dedicated supporting module to bypass App-Bound encryption by using IElevator service&nbsp;</li><li>While observed being spread via phishing emails resembling ClickFix, it itself also tries to mimic a fixing tool which users might use during troubleshooting problems they might have encountered&nbsp;</li></ul><h2>Introduction&nbsp;</h2>We’ve been closely observing various social engineering tactics, such as ClickFix and FakeCaptcha, for quite some time now. Tactics like these deceive users into thinking they are helping themselves, but by following the instructions from the attackers, they are actually inadvertently infecting their own devices. The steps the users are led to take commonly involve copying a malicious script that’s typically copied on background without user noticing. The instructions then prompt the user to paste and execute it via a PowerShell terminal or a Run prompt on Windows, displayed by a Win+R key combination.&nbsp;In a recent campaign using traditional phishing emails, we observed these scripts to distribute an interesting information stealer written in .NET, which we’ve named Glove.&nbsp;The stealer is relatively simple and contains minimal obfuscation or protection mechanisms, indicating it might still be in an early development phase. However, it uses a recent method to bypass App-Bound Encryption which was <a href="https://security.googleblog.com/2024/07/improving-security-of-chrome-cookies-on.html" target="_blank" rel="noreferrer noopener">introduced by Google</a> in Chrome 127. This bypass method involves using an IElevator service and was publicly <a href="https://github.com/xaitax/Chrome-App-Bound-Encryption-Decryption" target="_blank" rel="noreferrer noopener">disclosed by Alexander Hagenah</a> on Oct. 27, 2024.&nbsp;Other than stealing private data from browsers, it also tries to exfiltrate sensitive information from a list of 280 browser extensions and more than 80 locally installed applications. These extensions and applications typically involve cryptocurrency wallets, 2FA authenticators, password managers, email clients and others.&nbsp;<h2>Technical analysis&nbsp;</h2><h3>Distribution&nbsp;</h3>Even though ClickFix can take many forms, including inserting the crafted fake error messages into compromised websites or attacker-hosted pages, this campaign started with a user receiving a phishing email. Along with the e-mail, typically an attachment is present in HTML format. An HTML page like this contains typical ClickFix motives, showing a crafted fake error message stating that some content couldn’t be accessed properly, then advising the user how to fix it. By following the instructions, the user copies a malicious script to their clipboard and, after executing it in a terminal or the Run prompt, they unintentionally infect their own system. Below is an example of such an HTML page displayed when the user opens the attachment.&nbsp;

Under the hood, the script copied and executed by the user invokes a PowerShell command encoded by Base64. However, as is common in these campaigns, it’s followed by a couple of consecutive intermediary scripts.&nbsp;

After going through additional intermediary scripts, we get to a point where the script is calling and displaying an additional message to the user:&nbsp;

Following the messaging of the OneDrive example above, it attempts to appear as it should, as if it is fixing the DNS configuration. However, this is false, as there is no issue to begin with—the problem was artificially introduced to the user. The malicious script is contacting the attacker’s C&amp;C server to obtain Glove Stealer, ultimately leading the user’s device to become infected.&nbsp;In this specific case, the script downloads the Glove Stealer from this address below:&nbsp;https://master.volt-texs[.]online/api/c4slhp3l&nbsp;The payload is downloaded from the server as a text from the HTML page, and an analyst’s eye can immediately recognize the beginning of a PE file, just Base64 encoded.&nbsp;

<h2>Putting the gloves on to bypass and steal&nbsp;</h2>Naturally, this payload gets decoded and executed. Upon execution, Glove Stealer follows the whole narrative of ClickFix once again by displaying a terminal window with a text “Wait Search problems…”.&nbsp;

Along with the authors likely lacking some English skills, the “o” in the word “problems” is also a homoglyph, which is a character that looks the same (or almost identical) to an original one, yet with a different binary representation. However, this might not get properly interpreted in some terminal or environment configurations, as can be seen in our testing environment below.&nbsp;

The malware then pings another C&amp;C server, using a randomly generated string (a limited set of upper-cased letters and numbers) in the path, with the ID set to 0 to indicate it was successfully executed on the victim’s infected device:&nbsp;https://master.hdsjfkgsadoghdsiougds[.]space/mother/RANDOM_STRING?id=0&nbsp;This address is used multiple times during the malware execution to indicate successfully passing certain stages and submitting other data, such as encryption keys. For example, with an ID set to 1, it indicates that the initial malware configuration is set properly on the device.&nbsp;Before the data exfiltration takes place, Glove Stealer terminates any (browser) processes which contain any of the substrings mentioned below in the process name:&nbsp;<ul><li>chrome&nbsp;</li><li>yandex&nbsp;</li><li>browser&nbsp;</li><li>msedge&nbsp;</li><li>opera&nbsp;</li><li>brave&nbsp;</li><li>chromium&nbsp;</li><li>CryptoTab&nbsp;</li></ul>This is also being done in an infinite loop every 55 milliseconds and the malware steals data from other browsers, like Firefox.&nbsp;<h2>The exfiltration and data structure&nbsp;</h2>Glove Stealer parses and stores the information obtained from browsers into dedicated text files stored in the following directory structure:&nbsp;<ul><li>\AllPws.txt&nbsp;</li><li>\INFS.txt&nbsp;</li><li>\Cookies\&nbsp;</li><li>\Autofill\&nbsp;</li><li>\Restore\&nbsp;</li><li>\OTP\&nbsp;</li><li>\Wallets\&nbsp;</li></ul>All folders and files used to store the stolen data are prefixed with a path that represents a directory that contains the user's most recently used documents (via Environment.SpecialFolder.Recent), followed by an MD5 hash of from the combination of computer’s name and a SerialNumber of the device’s disk drive.&nbsp;The files stored in the folders which contain the stolen data from browser are labeled with the browser name and a possible postfix. For example, in case of cookies, this postfix would be the name of the exfiltrated browser profile (Default, Profile 1, Profile 2, …). As an example, the location and the name for Chrome cookies could be stored as follows:&nbsp;%APPDATA%\Microsoft\Windows\Recent\MD5_HASH\Cookies\Chrome_Default.txt&nbsp;The file INFS.txt contains a fingerprint of the device, including details like the OS, computer and username, maximum available RAM, language, CPU information and more. The remaining files stored in the dedicated directories don’t deviate from the used folder names and file names mentioned above.&nbsp;The cookies, wallets and other possible data are not obtained just from the browsers, but Glove Stealer is using vast lists of predefined locally installed applications and browser extensions, then tries to search for these and exfiltrate valuable data from them. Since the lists are too exhaustive to mention in the text (84 defined locations for the locally installed apps and 280 browser extensions), an interested reader can find these on our <a href="https://github.com/avast/ioc/tree/master/GloveStealer" target="_blank" rel="noreferrer noopener">GitHub. </a>To name here at least part of the scope, the Glove Stealer focuses on:&nbsp;<ul><li>Vast variety of cryptocurrency wallet browser extensions&nbsp;</li><li>2FA authenticators, including Google Authenticator, Microsoft, Aegis and LastPass, to name a few&nbsp;</li><li>Password managers, including Bitwarden, LastPass and KeePass, to name a few&nbsp;</li><li>Email clients like Thunderbird&nbsp;</li><li>Gaming platforms like Steam and Battle.net&nbsp;</li></ul>Data in which the stealer is interested in can be represented by searching for this list (not exhaustive) of files and locations for each of the app:&nbsp;<ul><li>\Network\Cookies&nbsp;</li><li>\Login Data&nbsp;</li><li>\Web Data&nbsp;</li><li>\Local Extension Settings&nbsp;</li><li>\Sync Extension Settings&nbsp;</li><li>\Local State&nbsp;</li><li>\LocalPrefs.json&nbsp;</li></ul>After the stealer is finished with data harvesting, the entire directory structure is then packed using FileZip and encrypted by 3DES in ECB mode and sent to a C&amp;C server. The key for the 3DES cipher is generated on the fly as a string value represented by DateTime.Now.Ticks string hashed using MD5.&nbsp;The ZIP file, representing the exfiltration package, is stored in the Recent directory with the name of MD5_HASH.xexe (the hash is still the computer’s name + SerialNumber). Immediately after it is encrypted using 3DES, it is renamed to MD5_HASHXE, where XE is an appended substring.&nbsp;To be able to decrypt the package, the attackers are sending this key in parameters using the ping C&amp;C server once again. For this, the ID parameter is set to 2 and the MD5 hash used as 3DES key immediately follows:&nbsp;https://master.hdsjfkgsadoghdsiougds[.]space/mother/RANDOM_STRING?id=2&amp;ids=MD5_key&nbsp;However, the exfiltrated package is sent to the other C&amp;C server as a POST request, with the data encoded by Base64:&nbsp;https://master.volt-texs[.]online/index2.php&nbsp;For the attackers to stay safe from losing the key, they also back-up the 3DES key here as well, using the non-hashed timestamp in the POST request.&nbsp;<h2>Supporting module for App-Bound encryption bypass&nbsp;</h2>In order to use the stolen data from Chrome, Glove Stealer needs to bypass the App-Bound encryption. To do this, it requests the original server once again to retrieve a .NET payload to do the job.&nbsp;This payload is a supporting module, which is rather small, and it is dedicated to bypassing the App-Bound encryption using IElevator service.&nbsp;https://master.volt-texs[.]online/postovoy/RANDOM_STRING&nbsp;Named as zagent.exe, this payload is downloaded and Base64-decoded into Chrome’s Program Files directory: %PROGRAMFILES%\Google\Chrome\Application\zagent.exe&nbsp;After execution, the module is using a hardcoded "app_bound_encrypted_key":" string for searching and retrieving the App-Bound encryption key stored in the local state file: %LOCALAPPDATA%\Google\Chrome\User Data\Local State&nbsp;&nbsp;

After the key is retrieved, it is Base64-decoded and stored in a dedicated file called chromekey.txt so it can be also accessed by Glove Stealer itself. After that, the C&amp;C server is pinged to indicate the bypass was successful (ID=4).&nbsp;Note that, since App-Bound encryption also performs a path validation for the location of the caller processes, this supporting module must be placed in the Chrome’s Program Files directory tree. As a result, Glove Stealer needs to acquire local admin privileges first to use this supporting module.&nbsp;<h2>Conclusion&nbsp;</h2>In this analysis, we described Glove Stealer, an information stealer observed in recent phishing campaigns that leverage social engineering tactics, such as ClickFix. In these tactics, the attackers aim to trick users into thinking they are helping themselves, when in reality, they are inadvertently infecting their devices by following the instructions provided by the attackers.&nbsp;Glove Stealer is capable of stealing various kind of information from many browsers, including Chrome, Firefox, Edge, Brave and others. To achieve this, Glove Stealer uses a dedicated supporting module that leverages IElevator service to bypass App-Bound encryption. Additionally, it steals sensitive data from two extensive lists: one representing locally installed applications and the other representing browser extensions. These include cryptocurrency wallets extensions, 2FA authenticators, password managers, email clients and more.&nbsp;<h3>Indicators of Compromise (IoCs)&nbsp;</h3>For more detailed list of IoCs, including the lists of locally installed apps and browser extensions, please visit our <a href="https://github.com/avast/ioc/tree/master/GloveStealer" target="_blank" rel="noreferrer noopener">GitHub</a>.&nbsp;Original script copied in clipboard:&nbsp; 2bf6fab237ab58ae6cfe78f9a61ab6dcaf55f437cb7a77878e2e6aae3b208e80&nbsp;Glove Stealer&nbsp;56da496329d54587c31119d8878a7831a9814a92839aa6a9873ceeb91575b11a&nbsp;Supporting module for App-Bound encryption bypass:&nbsp;86ad4082e086a0b9a22dc91a16d0d9be38232975ab4d3d035224fb6d6cc7a44c&nbsp;C&amp;C&nbsp;master.hdsjfkgsadoghdsiougds[.]space&nbsp;master.volt-texs[.]online&nbsp;

A .NET malware, bypasses Chrome's App-Bound Encryption, stealing data from browsers, crypto wallets, 2FA authenticators

Glove Stealer: Leveraging IElevator to Bypass App-Bound Encryption & Steal Sensitive Data

Imagine you are enjoying your weekend when you suddenly get a notification. You check it out, and it turns out it’s from Skype—yes, that old software you didn’t even remember you had installed. You open it up and find that someone has added you to a group called “Options Trading-86,” and you’re in there with 500 other people.&nbsp;

At first glance, it seems harmless—maybe even intriguing. The group claims to be a space for learning how to make money trading Bitcoin, led by an "analyst" from ARK Investment Management, no less. But as you scroll through the messages, things start to feel a little off.&nbsp;<h3>The Pitch: Free Advice from a "Professional"&nbsp;</h3>The first message comes from someone claiming to be Yassine Elmandjra, a real analyst from ARK Investment, welcoming everyone to this "charity class" on Bitcoin trading. They introduce Probit, a cryptocurrency exchange, and promise daily guidance on how to grow your wealth through Bitcoin contracts. The tone is friendly, and the offer of "free" advice sounds like a great deal.&nbsp;But here’s the thing—when was the last time a legitimate financial analyst offered free, daily trading tips to random people on Skype?&nbsp;

<h3>Building Trust Through Familiar Names&nbsp;</h3>This is where the scam starts to take shape. Scammers often borrow the names of trusted companies or individuals to build credibility. ARK Investment Management and Yassine Elmandjra are real, reputable entities, but their names have been hijacked here to create an illusion of legitimacy.&nbsp;

As you scroll further, you notice people chiming in about how much money they’ve made from following the advice. The group is lively, with people expressing gratitude for their daily profits and praising Elmandjra's accuracy. But are these people even real?&nbsp;<h3>The Emotional Hook: Get Rich Together&nbsp;</h3>Then the emotional manipulation kicks in. Participants share stories of how the pandemic affected their finances and how Bitcoin trading has given them a second chance. Others talk about securing their family's future or how this trading opportunity has changed their lives.&nbsp;

This is a classic scam tactic—use emotional appeals to lower your defenses. They want you to believe that by joining in, you too can turn things around and secure financial freedom. After all, if everyone else is making money, why shouldn’t you?&nbsp;<h3>The "Opportunity" Unfolds&nbsp;</h3>As you stay in the group, the real offer becomes clear. The group offers two investment options:&nbsp;<ol><li>Pay 20% of your profits as a commission.&nbsp;</li><li>A "guaranteed" 100% profit if you give them 50% of the earnings as commission, with the promise that any losses will be compensated by the investment advisor.&nbsp;</li></ol>Let’s stop here for a second. Guaranteed profits? Covered losses? In any real investment scenario, these promises would set off alarm bells. No legitimate financial advisor can guarantee profits, especially in the volatile world of cryptocurrency.&nbsp;<h3>Pressure to Invest Big&nbsp;</h3>The group doesn't waste time encouraging you to invest substantial amounts. They provide a handy guide on how much to start with, based on how much USDT (a cryptocurrency pegged to the US dollar) you have: $3,000, $6,000, or even $15,000.&nbsp;The message is clear: the more you invest, the more you can supposedly earn. But what’s really happening is the scammer trying to get as much money from you as possible before disappearing.&nbsp;<h3>The Push for Action&nbsp;</h3>Throughout the chat, there's constant pressure to act now. “If you want to learn more, sign up for a Probit account,” they say. The assistant, Lilian, is always available to help, promising easy registration and seamless trading. If you’re on the fence, testimonials from other group members provide glowing reviews of how easy and profitable it all is.&nbsp;Of course, none of this is real. The real goal is to get you to sign up for a fake account, give away personal information, and invest your money into an account you don’t control.&nbsp;<h3>What Happens Next?&nbsp;</h3>Once they’ve gained your trust and your money, the scammers will vanish. The group will likely continue to look active for a while, with bots or fake accounts continuing to post messages of success, but eventually, the entire operation will disappear, leaving you with empty pockets.&nbsp;<h3>Red Flags to Watch For&nbsp;</h3><ul><li>Unsolicited Group Invitations: Being added to a group out of nowhere is a huge red flag.&nbsp;</li><li>Impersonating Trusted Companies: Scammers often use the names of real, reputable entities to build credibility.&nbsp;</li><li>Promises of Guaranteed Profits: No legitimate financial advisor guarantees profits, especially in the world of cryptocurrency.&nbsp;</li><li>Emotional Manipulation: Scammers play on emotions, hoping you’ll be too focused on the promise of easy money to recognize the risks.&nbsp;</li><li>Pushing One Specific Platform: The heavy push to use Probit (or any single platform) should raise suspicion.&nbsp;</li></ul><h3>How to Protect Yourself&nbsp;</h3><ol><li>Always Be Skeptical of Unsolicited Offers: Whether it's a random group invite or a message from someone you don’t know, always question why you’re being contacted.&nbsp;</li><li>Verify the Source: Do your own research on the company or individual. In this case, contacting ARK Investment would reveal that they have no connection to this group.&nbsp;</li><li>Don’t Share Personal Information: Be cautious about sharing any personal or financial details with people or platforms you don’t trust.&nbsp;</li><li>Do Your Research: Always investigate the platforms being promoted. A quick online search might reveal whether others have reported it as a scam.&nbsp;</li></ol><h3>Final Thoughts&nbsp;</h3>This case illustrates just how far scammers are willing to go to exploit the growing interest in cryptocurrency. By creating a false sense of security, urgency, and community, they convince people to part with their money.&nbsp;Nowadays most of the threats we protect of are scams, more than virus, trojans or worms. Make sure you have a good security solution installed. Another good way to protect yourself is to stay informed. If something feels off or sounds too good to be true, it probably is. Be cautious, do your research, and never make decisions based on pressure or emotion.&nbsp;

A Cautionary Tale of Digital Deception

How a Skype notification turned into a costly lesson 

Malware Researcher at Gen

Researchers from Avast have discovered a flaw in the cryptographic schema of the Mallox ransomware variant that was prevalent during 2023 and early in 2024. Victims of the ransomware may be able to restore their files for free if they were attacked by this particular Mallox variant. The crypto-flaw was fixed around March 2024, so it is no longer possible to decrypt data encrypted by the later versions of Mallox ransomware.&nbsp;<h2>Overview of the Mallox ransomware&nbsp;</h2>The Mallox ransomware was previously called TargetCompany ransomware, which Avast released a decryptor for in January of 2022. Since then, the cryptographic schema has been evolving – the original cryptographic flaw was fixed by the malicious actors in February 2022, resulting in the decryptor for TargetCompany no longer working. However, as the cryptographic schema kept evolving, the authors made new mistakes which allowed data decryption without having the private ECDH key.&nbsp;Based on our userbase telemetry, the following picture shows countries with the largest number of blocked attacks of the Mallox ransomware from Oct 2023 to Oct 2024:&nbsp;

The top 5 countries (based on number of blocked attacks) are:&nbsp;

<h3>Leak Site&nbsp;</h3>Mallox thread actor also has an <a href="https://x.com/___Mallox___" target="_blank" rel="noreferrer noopener">account on X</a>, but it has not been maintained since March 2023. Their leak site on the Dark Web shows the list of victims up to June 2024.&nbsp;

<h3>How to recognize the decryptable version of Mallox?&nbsp;</h3>The decryptable versions of Mallox were spreading from January of 2023 to about February 2024 (based on the compile time of the samples). Decryptable files can be recognized by the following extensions:&nbsp;<ul><li>.bitenc&nbsp;</li><li>.ma1x0&nbsp;</li><li>.mallab&nbsp;</li><li>.malox, .mallox, .mallox, .malloxx&nbsp;</li><li>.xollam&nbsp;</li></ul>During file encryption, Mallox ransomware leaves a ransom note in each folder. The possible file names are:&nbsp;<ul><li>FILE RECOVERY.txt&nbsp;</li><li>HOW TO BACK FILES.txt&nbsp;</li><li>HOW TO RESTORE FILES.txt&nbsp;</li></ul>The following pictures show the ransom note content:&nbsp;

<h3>How to use the Mallox ransomware decryptor</h3><ol><li>Download the decryptor <a href="https://files.avast.com/files/decryptor/avast_decryptor_mallox64.exe" target="_blank" rel="noreferrer noopener">here</a>. If you still use 32-bit Windows, you can also get the <a href="https://files.avast.com/files/decryptor/avast_decryptor_mallox64.exe" target="_blank" rel="noreferrer noopener">32-bit version of decryptor</a>.&nbsp;</li><li>Run the decryptor, preferably as an administrator. It starts as a wizard, leading you through the configuration of the decryption process. The decryptor must be executed on the same computer where the files were encrypted. &nbsp;</li></ol>

<ol start="3"><li>On the next page, the user is asked to provide a list of locations (drives, folders, files) that are to be decrypted. By default, the decryptor provides a list of all local disk drives.&nbsp;&nbsp;</li></ol>

On the final page, you can opt-in to back up your encrypted files. These backups may help if anything goes wrong during the decryption process. This option is selected by default, which we recommend. After clicking Decrypt, the decryption process begins. Let the decryptor work and wait until it finishes decrypting all of your files.

<h3>Indicators of Compromise (IOCs)</h3>The list of Mallox samples and extensions of encrypted files follow: &nbsp;a340ef5adb00a2bf1a0735600491ca98ac8045b57db892dedc27575a53b25056&nbsp;<ul><li>.bitenc&nbsp;</li></ul>&nbsp;003ea0712cd31a75f5dfb6a23d2d12ea1e615f7601574ade09b6b61e3b7ed2b0&nbsp;25719f4afa357af8141e42fa9a0499c08fd94011690b8e75e8a22ce6af31c825&nbsp;311d3c07ceabb08fd3f2486ad99fb6a7b2ea881135ef3f75840f9fd859fec537&nbsp;34c04dff26da88c339eeb1220f7e8ac8cfc47a340237c37edbae96c8fd1ee5e5&nbsp;6976ffaa2deac082dedcd30e2ecb2faa86e5361d1c22d6678baf44985ef217ce&nbsp;8bc92f4a5b1429397be96fe264a543752e92d73a4e7ed9fbdbb21e654c2cb838&nbsp;a2b63fae8c83a02f57fff4d932a1e846765a70b18bfae65c127f72010674cce8&nbsp;b87712413054cffeb98212babcea85c8f6f460e28269717c31e2e84bd4192d02&nbsp;dd871fe134be4b972c6e22efbb6c7d59d908127c3148ef1958c43ba5a33185ed&nbsp;<ul><li>.ma1x0&nbsp;</li></ul>&nbsp;0653d7a8a2267e6e7db5c8f39afca7f358ce097d7c0724c0c70493f6cf30f43d&nbsp;0706c9d8413a6ffb7dc68d6a69a9ced942ad2e9f3318a2cf2e535d44661b52a2&nbsp;1da63eb16aa6d7ec9e6d46f3897275bb238ac8156fcee3552bb3b41af73fee44&nbsp;311eac772bea66edba4c9f180d55776f0e8c40c64d6066de354ae68504f69a77&nbsp;3742b60308d2a7fb47c69a625dfdaae16561db5ee7353ce9a8a02110961192f5&nbsp;374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a&nbsp;3f044ba34bdf3c049e1f2468c91339ffc71d61fea913a43f876b8ba05211d0dc&nbsp;3fc75983ed3c5ac1879d862760523e2986907fc9a177c9b740b5b36e6e28f9d9&nbsp;4674370e64733f2f634251da6967fe96f02ac4654543b36b1b80e765495bfe4e&nbsp;5133aab38acbe99380dccf5f69150c887467a910cc3052b5054ffca56e149847&nbsp;(and 30 more)&nbsp;<ul><li>.mallab&nbsp;</li></ul>&nbsp;03596723ecb5be777b1e3ec5deb414dc78155a30a466b2b25a4574f4db9a568a&nbsp;0e37d23af67569980f74ee9fd76ffc03280ea79ea581cc00c8c5030049739e29&nbsp;116bcf7ff3927139f92fcafad0ee8105e90c6e11f57e913976d65b1d326874f6&nbsp;197e192e8c3a7df7a4e00a7c67d91bbf1cff1dbe756ec6e5e446f9a16df96ad8&nbsp;1bc30c4abebb326a548401b665540b5203591599220889907f316f5ebdf99dd5&nbsp;1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584&nbsp;1c8b6d5b79d7d909b7ee22cccf8f71c1bd8182eedfb9960c94776620e4543d13&nbsp;1d217728faecddc1699af6761a9dfb22fe0ed648abc47639017c3eac7cfa0f85&nbsp;1db038fea314da6884990e1ecdd5579ade64803db4d29384c9ac752cf44a354c&nbsp;1e7342641f88f9df8b7830544821531544585f30bea7fd895b7db8a0a461896b&nbsp;(and 74 more)&nbsp;<ul><li>.mallox&nbsp;</li></ul>&nbsp;0064cafe8474c7a29e514d16825cb2a2b804e64c3f0d7f660b3b3e76cb37d7cc&nbsp;1cf818229b7d06a4caf2c6bd4b3b3e8b2cc865ba7b77b7176f412ccb08e3f6d8&nbsp;55d568e14868cc4a2583db29688996bc43f8f27bfb8b3ddb95662f7f9deac4b4&nbsp;5abe151418fc18090eba2c62ffdefe738250151f34ea1b290f63df702f68deac&nbsp;7105930cb8859795303ebd254ad785faf13d6dacd41fda733a29f40e2c551fc6&nbsp;90672eb92326724cc125c276faa3c8bba7b837d0b9b13977c4c67330d7cfddae&nbsp;ce198296ebb3def9b1c929b3e54072e831e05d993eda48129987ef93d717a7d6&nbsp;df29d5c4a750663440ce76d6804ce88e03faeef9591ec0b3b9ca348a6c930b7f&nbsp;2044bc33cf855b4add30312da75ac8daa408197408da88ecd520d90bdef550ff&nbsp;3cd0e666eef8439064a78aa8d60669c9ec98edea60ec0894548bad6c97954970&nbsp;(and 8 more)&nbsp;<ul><li>.malloxx&nbsp;</li></ul>&nbsp;0427a9f68d2385f7d5ba9e9c8e5c7f1b6e829868ef0a8bc89b2f6dae2f2020c4&nbsp;0463277782f9e98b0e7a028cea0f689a81cf080fa0d64d4de8ef4803bb1bf03a&nbsp;19570b184cacd8288a3d0756eeff7568af9970afc2d63dce69101d5ece88dfb6&nbsp;21f33c588bba58522d5e475f43012a886d42be956c644cc000e87c59c4cf9008&nbsp;2b4ec26fc1c25f56e5469f3550815cf6e488eab6641fbf661464ec7170a66d93&nbsp;2fd3c8fab2cfaaabf53d6c50e515dd5d1ef6eceeebdd5509c23030c4d54cb014&nbsp;36079d6856ba2935e17401f80caa160195460e0afefc191b0fe04c31d2f9f4b6&nbsp;3ab42c1bd05fabaf3276a66f0a9f7d8a509aec4835b321d03b3165a71dd5924d&nbsp;66038da15ef19678b4a98531b045e3e7e924a8f1e508732054648fac77a5fd9f&nbsp;75498c3fa25bbbcdaa970d83376c4b8f6e5403980141125e9b05a389584cca8b&nbsp;(and 26 more)&nbsp;<ul><li>.malox&nbsp;</li></ul>&nbsp;86ec7e79b5eb6f22fc657203b8bc0da895f09045d3252030130eff0830018466&nbsp;bfcf5d57790f28dd78d5f351776e0fee4efd537e9490c3105d5c6bbf37e8b241&nbsp;<ul><li>.maloxx&nbsp;</li></ul>&nbsp;0598708adf2aabe3aa81919f50dc0fd65acf4d4ed80ad32dc43d09a3bab7b50a&nbsp;10f96f64659415e46c3f2f823bdb855aab42d0bfced811c9a3b72aea5f22d880&nbsp;258101f7b1767837217a242fee4e71896df06d758e97fe79d996224d67f7d136&nbsp;4ed74a205fad15c843174d7d8b30ae60a181e79f31cc30ebc683072f187e4cdd&nbsp;52e281f8cde1fd07b54aecbac93cc97890a3c59ff8bac5627b5dfbd7c07a4e48&nbsp;7f81d7b71fff4ab3abc82e1ccf83bf386bb1172b0978238ae3ff9ea912c4e7e3&nbsp;9acbc6b9342e22059c02db89c629d56b2ada8b56abe94f2a901ed1252beac2cd&nbsp;<ul><li>.xollam&nbsp;</li></ul>

Researchers uncover flaw in Mallox ransomware, offering free file recovery for early victims

Decrypted: Mallox ransomware 

Brand & Social Media Manager

In today’s digital age, where cybersecurity concerns touch every aspect of our lives — from personal privacy to global business operations — staying informed is crucial. As cyberthreats continue to evolve and cyberattacks persist, our analysis of the second quarter reveals key trends, insights and strategies to protect yourself and your organization.<h2>The Cyberthreat Landscape: What We Saw April - June 2024</h2>If you’re wondering how many cyberattacks are happening daily, here’s the sobering truth: our family of brands blocks over a billion cyberattacks every single month. Yes, a billion. The overwhelming majority (90%) of these attacks come from <a href="https://us.norton.com/blog/emerging-threats/what-is-social-engineering">social </a><a href="https://us.norton.com/blog/emerging-threats/what-is-social-engineering" target="_blank" title="What is social engineering?">engineering</a>, which targets human psychology rather than technical systems. The goal? Trick you into making mistakes that lead to data breaches. Even though the overall number of attacks slightly declined from April to June, cybercriminals are evolving faster than ever. Total threats were 46% higher than in 2023, and it’s clear that no one can afford to lower their guard.<h2>Social Engineering Attacks: How Scammers Trick You</h2>When it comes to cybersecurity threats, social engineering is public enemy number one. More than 90% of all cyberthreats in 2024 so far were driven by this method. Scammers prey on human nature, getting users to click on malicious links, share passwords or download malware. The most important line of defense? User education and cyber awareness training to recognize and avoid these traps before it’s too late.<h2>Web Browsing: The Riskiest Time Online</h2>Ever wondered when you’re most vulnerable to cyberattacks? The answer is simple: while browsing the web. A staggering 95% of attacks occur while you’re online, making <a href="https://us.norton.com/" target="_blank" title="Norton: real-time threat protection">real-time threat protection</a> a must-have. Although there was a small dip in threats from April to June, it’s no cause for celebration. The landscape is still dangerous, with scammers constantly adapting their methods to catch you off guard.<h2>Fake Antivirus Scams: Back and More Dangerous Than Ever</h2>You may think you’re too savvy to fall for a<a href="https://us.norton.com/blog/emerging-threats/fake-antivirus-scam" target="_blank" title="Antivirus scams"> fake antivirus scam</a> but think again. These scams are making a comeback, and they’re more convincing than ever. Scammers bypass typical security warnings to push fake virus alerts, tricking users into buying fake security software to ‘fix’ non-existent problems. Cybercriminals are banking on increased anxiety around cybersecurity threats, and they’re capitalizing on it.<h2>What Scams You Should Look Out For?&nbsp;</h2>Scammers are diversifying their attacks, targeting everyday people through multiple fronts. Some of the most common types of scams in Q2 2024 included:<ul><li>Job Scams: Promising lucrative <a href="https://www.gendigital.com/blog/news/innovation/part-time-job-scams" target="_blank" title="Part-time job scams">part-time jobs</a> or quick investments that sound too good to be true. These scams often lead to stolen money or personal information.</li><li>Online Dating Scams: Fraudsters create fake online profiles, build relationships with their victims, then ask for financial support or personal data.</li><li>Event-Related Scams: With big events like elections and concerts, scammers create fraudulent donation campaigns or phishing websites to steal your money and information.</li></ul><h2>The Rise of Identity Theft in 2024</h2>If you’re concerned about identity theft, you’re not alone. Threats targeting personal information are on the up and up, particularly through tools like information stealers (e.g., AgentTesla) and mobile banking trojans. These types of malware harvest sensitive data, whether from your desktop or your mobile device and then use it for fraud or theft.&nbsp;For 2024 and beyond, <a href="https://lifelock.norton.com/" target="_blank" title="Identity Theft Protection">protecting your personal information</a> should be a top priority.<h2>Ransomware Attacks Surge in 2024</h2>One of the most talked-about cybersecurity threats in 2024 is the rise in <a href="https://blog.avast.com/threat-report-q2-2024" title="ransomeware increase">ransomware attacks</a>. These attacks increased by 24% this quarter, with hotspots in the US, UK and India. Ransomware isn’t just about locking up your files anymore — criminals are using it to target businesses, government institutions and even individuals.We’ve released free decryption tools for ransomware victims (like those targeted by DoNex), and we’re actively working to disrupt the infrastructure behind ransomware attacks. If you’re concerned about ransomware, stay updated with the latest cybersecurity tools and software.<h2>Botnet Crackdown: Major Wins in Q2 2024</h2>One bright spot this quarter was the takedown of several botnets — networks of compromised computers used to launch massive attacks.<ul><li>Operation Endgame: Led by Europol, this operation targeted key botnet providers, leading to multiple arrests and significant setbacks for malicious operations. The impact of these botnets represents a big blow to cybercriminal networks.</li><li>U.S. Department of Justice Actions: The DOJ played a pivotal role in dismantling the notorious 911 S5 botnet. Additionally, actions against the DDoSia botnet led to several arrests, further disrupting the operations of these malicious entities.</li><li>Remote Access Trojans (RATs): Operations aimed at combating RATs, such as Hive, have yielded positive results. These efforts have effectively addressed threats that grant unauthorized access to systems, contributing to enhanced overall cybersecurity.</li></ul><h2>The Future of Cybersecurity: Innovation, Collaboration and Training</h2>Looking ahead, cybersecurity innovation will hinge on two things: advanced technologies like artificial intelligence (AI) and machine learning (ML), and collaboration between cybersecurity experts, policymakers and industry leaders. AI and ML allow us to detect and respond to threats faster, smarter and more efficiently. Combine that with skilled cybersecurity professionals and robust training programs, and we CAN and WILL stay ahead of evolving threats.<h3>A Future-Ready Approach to Cybersecurity</h3>As technology continues to advance, organizations must remain agile and forward-thinking. The second quarter of 2024 has shown us that the fight against cybercrime is relentless. But, at Gen, we’re doubling down on our commitment to protect digital freedom. From social engineering to ransomware, identity theft to botnets, we’re here to help you navigate these challenges and stay safe online. The future of cybersecurity isn’t just about defense; it’s about innovation, growth and creating a safer digital space for all.Explore more about the latest cybersecurity threats and how you can protect yourself. Read the <a href="https://www.gendigital.com/blog/news/innovation/q2-2024-threat-report" target="_blank" title="Q2 2024 Threat Report">full threat report here</a>.