Phemedrone Stealer Targets Windows Defender Flaw Despite Patch

Cybersecurity specialists have uncovered the lively exploitation of CVE-2023-36025, which additionally led to the dissemination of a brand new pressure of malware referred to as Phemedrone Stealer. 

This malware explicitly targets net browsers and collects information from cryptocurrency wallets and messaging purposes like Telegram, Steam and Discord. 

Moreover, Phemedrone gathers system info, together with {hardware} particulars and placement, sending the stolen information to the attackers by means of Telegram or their command-and-control (C2) server.

The vulnerability in query impacts Microsoft Home windows Defender SmartScreen, ensuing from insufficient checks on Web Shortcut (.url) information. 

Menace actors leverage this loophole by creating .url information that obtain and execute malicious scripts, bypassing Home windows Defender SmartScreen warnings. 

Microsoft addressed this vulnerability on November 14 2023. Nonetheless, its exploitation within the wild prompted the Cybersecurity and Infrastructure Safety Company (CISA) to incorporate it within the Identified Exploited Vulnerabilities (KEV) checklist on the identical day.

Proof means that since its discovery, varied malware campaigns, together with these distributing the Phemedrone Stealer payload, have included this vulnerability into their assault chains. The assault vector primarily entails internet hosting malicious .url information on cloud companies like Discord or FileTransfer.io, with attackers utilizing URL shorteners to disguise these information.

As soon as the malicious .url file exploiting CVE-2023-36025 is executed, the malware employs protection evasion strategies, reminiscent of DLL sideloading and dynamic API resolving, to obfuscate its presence. The malware achieves persistence by creating scheduled duties and makes use of an encrypted second-stage loader.

Learn extra on CVE-2023-36025 exploitation: BattleRoyal Cluster Indicators DarkGate Surge

Second Stage Extraction and Exfiltration

Phemedrone Stealer’s second stage entails an open-source shellcode referred to as Donut, enabling the execution of assorted file sorts in reminiscence. The malware dynamically targets a broad vary of purposes and companies. It then extracts delicate info, together with credentials, from browsers, crypto wallets, Discord, FileZilla, Steam and extra.

The malware additionally employs an elaborate information exfiltration course of, compressing and sending the harvested information by means of the Telegram API. It ensures information integrity by validating the Telegram API token and transmits an in depth system info report back to the attackers.

Regardless of Microsoft issuing a patch for CVE-2023-36025, Pattern Micro mentioned menace actors persist in exploiting this vulnerability, emphasizing the necessity for organizations to replace their Home windows installations promptly.

“Organizations should be certain to replace Microsoft Home windows installations to forestall being uncovered to the Microsoft Home windows Defender SmartScreen Bypass,” reads the advisory.

“Public proof-of-concept exploit code exists on the net rising the chance to organizations who haven’t but up to date to the newest patched model.”