A recent cybersecurity incident has revealed a new cyber attack campaign that uses fake MSIX Windows app package files to distribute a malware loader called GHOSTPULSE [3]. This campaign targets popular software installers like Google Chrome, Microsoft Edge [1] [2] [3], Brave [1] [2] [3], Grammarly [1] [2] [3], and Cisco Webex [1] [2] [3]. The attackers employ various tactics [3], such as compromised websites, SEO poisoning [1] [2], and malvertising [1] [2], to entice potential victims into downloading these packages. Once the MSIX file is launched [1] [2], it prompts the user to click the Install button [1] [2], resulting in the stealthy download of GHOSTPULSE from a remote server via a PowerShell script [1].
Description
The attack unfolds in multiple stages. Initially, a TAR archive file is used as the first payload, containing an executable that disguises itself as the Oracle VM VirtualBox service [1]. Additionally, the malware exploits vulnerabilities in gup.exe through DLL side-loading. GHOSTPULSE acts as a loader and utilizes process doppelgänging to execute the final malware [1] [3], which includes SectopRAT [1], Rhadamanthys [1] [2] [3], Vidar [1] [2] [3], Lumma [1] [2] [3], and NetSupport RAT [1] [2] [3].
The initial payload of GHOSTPULSE is a TAR archive file that includes a legitimate binary bundled with Notepad++. The archive also contains a trojanized version of libcurl.dll [2], which exploits DLL side-loading [2]. The tampered DLL file then proceeds to execute an encrypted payload via mshtml.dll [2], ultimately loading GHOSTPULSE [2].
Conclusion
This new cyber attack strategy is a significant concern as it specifically targets popular software and employs sophisticated techniques to evade detection by antivirus scans. Organizations and individuals must remain vigilant and take necessary precautions to protect themselves from this evolving threat. The use of fake MSIX Windows app package files and the exploitation of DLL side-loading vulnerabilities highlight the need for robust cybersecurity measures. It is crucial to stay updated on the latest security practices and technologies to mitigate the risks posed by such attacks in the future.
References
[1] https://thehackernews.com/2023/10/hackers-using-msix-app-packages-to.html
[2] https://www.linkedin.com/pulse/hackers-using-msix-app-packages-infect-windows-pcs-ghostpulse-16xqf
[3] https://www.iaesjournal.com/cybercriminals-employ-msix-application-packages-to-inflict-ghostpulse-malware-on-windows-pcs/
