Hackers Hide Malware in Images to Deploy VIP Keylogger and 0bj3ctivity Stealer
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-11882 | Memory Corruption RCE in Microsoft Office via Legacy Equation Editor CVE-2017-11882 is a memory corruption vulnerability (CWE-119) in Microsoft Office, residing in the legacy Microsoft Equation Editor component (EQNEDT32.EXE), that allows remote code execution in the context of the current user. Attackers trigger it by persuading a user to open a crafted document, most commonly an RTF file or other Office document carrying a malicious embedded equation object, which overflows a buffer while the equation content is parsed. Successful exploitation lets the attacker run arbitrary code with the privileges of the signed-in user, a typical foothold for malware delivery and, per CISA, for ransomware operations. Any environment running affected Microsoft Office builds is exposed; the source data does not enumerate specific affected version ranges. The flaw is confirmed exploited in the wild: it was added to the CISA Known Exploited Vulnerabilities catalog on 2021-11-03 with known ransomware use and holds a 99.9% EPSS score (percentile 100), though the source data lists no public PoC. Do: Apply Microsoft's Office security updates (November 2017 or later) across all endpoints, prioritizing this KEV-listed flaw given its known ransomware use. On systems that cannot yet be patched, disable or unregister the legacy Equation Editor (EQNEDT32.EXE) and consider blocking or warning on RTF attachments as interim mitigations. Check for indicators of abuse such as EQNEDT32.EXE spawning unexpected child processes after document opens. | 7.8 | 100% | KEV ransomware PoC ×10 |
| masshundreds of millions of users/installations (Office is near-ubiquitous on Windows and in enterprises; the share still unpatched is unknown) |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | archive.org | ns, attackers hid malicious code in images they uploaded to archive[.]org, a file-hosting website, and used the same .NET loader to |
Full article535 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananJan 16, 2025Malware / Ransomware
Threat actors have been observed concealing malicious code in images to deliver malware such as VIP Keylogger and 0bj3ctivity Stealer as part of separate campaigns.
"In both campaigns, attackers hid malicious code in images they uploaded to archive[.]org, a file-hosting website, and used the same .NET loader to install their final payloads," HP Wolf Security said in its Threat Insights Report for Q3 2024 shared with The Hacker News.
The starting point is a phishing email that masquerades as invoices and purchase orders to trick recipients into opening malicious attachments, such as Microsoft Excel documents, that, when opened, exploits a known security flaw in Equation Editor (CVE-2017-11882) to download a VBScript file.
The script, for its part, is designed to decode and run a PowerShell script that retrieves an image hosted on archive[.]org and extracts a Base64-encoded code, which is subsequently decoded into a .NET executable and executed.
The .NET executable serves as a loader to download VIP Keylogger from a given URL and runs it, allowing the threat actors to steal a wide range of data from the infected systems, including keystrokes, clipboard content, screenshots, and credentials. VIP Keylogger shares functional overlaps with Snake Keylogger and 404 Keylogger.
A similar campaign has been found to send malicious archive files to targets by email. These messages, which pose as requests for quotations, aim to lure visitors into opening a JavaScript file within the archive that then launches a PowerShell script.
Like in the previous case, the PowerShell script downloads an image from a remote server, parses the Base64-encoded code within it, and runs the same .NET-based loader. What's different is that the attack chain culminates with the deployment of an information stealer named 0bj3ctivity.
The parallels between the two campaigns suggest that threat actors are leveraging malware kits to improve the overall efficiency, while also lowering the time and technical expertise needed to craft the attacks.
HP Wolf Security also said it observed bad actors resorting to HTML smuggling techniques to drop the XWorm remote access trojan (RAT) by means of an AutoIt dropper, echoing prior campaigns that distributed AsyncRAT in a similar fashion.
"Notably, the HTML files bore hallmarks suggesting that they had been written with the help of GenAI," HP said. "The activity points to the growing use of GenAI in the initial access and malware delivery stages of the attack chain."
"Indeed, threat actors stand to gain numerous benefits from GenAI, from scaling attacks and creating variations that could increase their infection rates, to making attribution by network defenders more difficult."
That's not all. Threat actors have been spotted creating GitHub repositories advertising video game cheat and modification tools in order to deploy the Lumma Stealer malware using a .NET dropper.
"The campaigns analyzed provide further evidence of the commodification of cybercrime," Alex Holland, principal threat researcher in the HP Security Lab, said. "As malware-by-numbers kits are more freely available, affordable, and easy to use, even novices with limited skills and knowledge can put together an effective infection chain."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/01/hackers-hide-malware-in-images-to.html