GoKawiilDeveloping ClickFix-style attacks has just gotten much easier, thanks to a newly distributed malware-as-a-service (MaaS) platform that automates every step of the social engineering technique for would-be attackers, researchers have found.
A developer operating under the name "VenomStealer" is selling a MaaS platform of the same name on cybercriminal forums and networks, researchers from BlackFog revealed in a report published Tuesday. Venom Stealer allows attackers to create a persistent, multistage pipeline from initial infection to credential theft, cryptocurrency wallet access, and data exfiltration based on the initial ClickFix interaction.
"Venom stands out from commodity stealers like Lumma, Vidar, and RedLine because it goes beyond credential harvesting," BlackFog founder and CEO Darren Williams wrote in the report. "It builds ClickFix social engineering directly into the operator panel, automates every step after initial access, and creates a continuous exfiltration pipeline that does not end when the initial payload finishes running."
Related:The Forgotten Endpoint: Security Risks of Dormant Devices
Touted on cybercriminal forums as "the Apex Predator of Wallet Extraction," the platform is sold on a subscription basis for $250 a month, or $1,800 for lifetime access, according to Williams. There a vetted application process, Telegram-based licensing, and a 15% affiliate program for Venom Stealer, which delivers a native C++ binary payload compiled per-operator from the web panel.
Unlike traditional stealers that simply execute once, exfiltrate data, and exit, Venom Stealer continuously scans the system to harvests credentials, session cookies, and browser data; targets cryptocurrency wallets and stored secrets; and automates wallet cracking and fund draining, according to BlackFog's report.
Moreover, despite its relatively new presence on the commodity MaaS market, the operation behind Venom Stealer already appears to be a thriving business, Williams noted. So far in the month of March alone, its developer has already shipped multiple updates to the platform.
Step-By-Step ClickFix by Design
An attack built with Venom Stealer begins when a prospective victim lands on a ClickFix page hosted by the operator. The platform ships four templates per platform (Windows and macOS), a fake Cloudflare CAPTCHA, a fake OS update, a fake SSL certificate error, and a fake font install page. Each one asks the target to open a Run dialog or Terminal, copy and paste a command, and hit Enter.
"Because the target initiates execution themselves, the process appears user-initiated and bypasses detection logic built around parent-child process relationships," Williams explained.
... continue reading