malware analysis

Bilingual

ACR Stealer: ClickFix, Etherhiding, and Stego, Oh My
2 months ago
- The ACR Stealer campaign uses a multi-stage infection chain starting with ClickFix initial access via pcalua.exe executing PowerShell.
- Stage 1: pcalua.exe runs PowerShell to launch mshta.exe, which downloads an .mp3 file containing obfuscated VBScript.
- Stage 2: The VBScript creates a scheduled task 'serviceyib' that runs PowerShell with an encoded command.
- Stage 3: PowerShell performs AMSI bypass via custom RC4 decryption, then downloads and executes a next stage from a C2 domain.
- Stage 4: Steganography is used—an image from i.ibb.co is chunked into 8x8 blocks, decoded via grayscale averaging, XORed, and decompressed to reveal more PowerShell.
- Stage 5: A shellcode loader performs reflective process injection to load a compressed PE as the final payload.
- Stage 6: The final payload is ACR Stealer, masquerading as WPA.exe, with heavy anti-analysis (no static imports, direct syscalls, PEB walking).
- The article notes that the complex obfuscation may indicate AI-assisted development, making such techniques accessible to more threat actors.
Shai-Hulud and the risks of external dependencies
2 months ago
- Shai-Hulud is an npm supply-chain malware by TeamPCP, named after the sandworms from Dune, which compromised 500 packages, breached hundreds of organizations, stole 300 GB of data, and exfiltrated ~500,000 credentials.
- The malware's source code was released on May 11; analysis shows it uses simple tricks like credential theft and string obfuscation rather than advanced exploits, with inconsistent, buggy, and incomplete code.
- It works by injecting malicious dependencies or preinstall scripts via OIDC or CI pipelines, stealing credentials (AWS, SSH, GitHub tokens, etc.), and exfiltrating data through encrypted channels or compromised GitHub repos.
- Key weaknesses in modern development exploited: blind trust in dependencies and ease of importing code; risks include editor integrations and CI systems running malicious scripts.
- Recommendations include reducing dependencies, using sandboxed runtimes like Deno, enforcing zero-trust permissions, and adopting stable release channels for auditing; npm now blocks install scripts from dependencies to mitigate such attacks.
CPU-Z Backdoor: Detecting Malicious Implants at Scale
2 months ago
- AI writing code introduces security risks as code review becomes impossible due to speed.
- Software supply chain attacks are prevalent; attackers exploit vulnerabilities within days of disclosure.
- RevEng.AI analyzes binary artifacts to detect malicious components before production deployment.
- Case study: CPU-Z supply chain attack distributed trojanized installers containing STX RAT malware.
- The multi-stage infection chain used DLL loaders, API resolution, shellcode injection, and final payload delivery.
- RevEng.AI's Reverser platform automates triage, decompilation, and IoC extraction for faster analysis.
- The analysis mapped capabilities to MITRE ATT&CK and generated a YARA rule for automated remediation.

malware analysis

ACR Stealer: ClickFix, Etherhiding, and Stego, Oh My

Shai-Hulud and the risks of external dependencies

CPU-Z Backdoor: Detecting Malicious Implants at Scale