A newly discovered threat campaign is targeting technology enthusiasts, including gamers and content creators, by posing as popular applications such as ChatGPT and Claude. This operation involves the dissemination of the DinDoor backdoor through counterfeit installers available on reputable platforms, leaving unsuspecting users vulnerable.
Malicious Software Installers Targeting Users
The attackers behind this campaign have cleverly utilized compromised YouTube channels to direct viewers to these harmful files. With some of these videos amassing over 50,000 views, the scale of the threat is substantial. Malwarebytes researchers uncovered this scheme after observing dubious installer packages on platforms like GitHub and SourceForge.
The malware is disguised as legitimate tools including ChatGPT, Claude, and others like Ableton Live and AutoTune, making it particularly deceptive. By leveraging the trustworthiness of platforms like GitHub, the attackers make their malicious software appear credible, reducing the likelihood of user suspicion.
Mechanics of the DinDoor Backdoor
Once a user downloads the fake installer from platforms such as GitHub or SourceForge, the infection process begins. The user, believing they are installing genuine software, initiates a command that downloads a malicious MSI installer file. This file executes additional scripts that further embed the malware into the system.
The backdoor establishes a connection with a command-and-control server, facilitating the installation of a remote access Trojan (RAT). This RAT is capable of extracting data from browsers and cryptocurrency wallets, taking screenshots, and even streaming video from the victim’s device without detection.
Broader Impact and Prevention Measures
The malware, distributed through various vectors including fake game boosters and AI tools, underscores the attackers’ broad approach. The RAT, powered by the Deno JavaScript runtime, features extensive capabilities for data theft and system control, targeting over 50 types of cryptocurrency wallets and browser extensions.
To mitigate risks, users should only download software from official sources and verify the authenticity of files by checking digital signatures. Exercising caution with free or cracked software versions is crucial to avoid falling victim to such deceptive practices.
In conclusion, staying informed and adopting vigilant software installation practices are key defenses against these evolving cyber threats. As hackers continue to exploit trusted platforms, awareness and proactive measures remain the best tools for protection.
