Downloading software illegally? You might want to check your bank account

Saving on software licenses might come with a bigger price. Researchers have found that promoted cracks and installers contain malware that can steal sensitive information.

Those who don’t fancy paying for Photoshop, Lightroom, AutoCAD, or other software might be tempted to use cracks available on the internet. This small piece of code can break software protection and allow you to use it for free.

Researchers from the security firm Trend Micro have unveiled a scheme in which attackers spread fake installers packed with hardly detectable and information-stealing malware via YouTube and other social media platforms.

Once the user clicks on a malicious link, which often appears in search results or comments on various social media platforms, a compressed file is downloaded from reputable file hosting sites such as Mediafire or Mega.nz.

What seems to be a legitimate software installer actually contains malware, categorized as an infostealer. This type of malware is designed to steal sensitive information from an infected system.

This can include your credentials, financial information, personal data, and other sensitive information. Threat actors can exploit such data for identity theft, fraud, or other malicious purposes.

Malicious links on OpenSea and Soundcloud

In their report, researchers show examples of malicious links with malware promoted on the least expected platforms, such as the NFT marketplace OpenSea or the sharing platform SoundCloud.

For example, if a user searches for Autodesk Keygen, a program that generates product serial numbers, the search results show these credible sites. The entry on OpenSea contained a shortened link that redirects the user to the actual malicious link. The entry on SoundCloud also hosted the shortened download link with a corresponding description.

Threat actors might use shortened links to prevent scraping sites from accessing the download link.

How does malware evade detection?

There are a couple of ways that this malware manages to evade detection. Firstly, threat actors often use reputable file hosting services to conceal the origin of their malware and make detection and removal more difficult. Most antivirus programs will only detect malware if the exact link is discovered before the download.

Also, many malicious downloads are password-protected, encoded, and weigh 900MB in size, which complicates analysis in security environments such as sandboxes. Furthermore, such big files can not be uploaded to VirusTotal, allowing the malware to evade early detection.

The operation uses legitimate files and relies on techniques like DLL sideloading or process injection to run its payload.The Infostealers discovered were:

• LUMMASTEALER
• PRIVATELOADER
• MARSSTEALER
• AMADEY
• PENGUISH
• VIDAR