The figure below shows the timeline of the phishing sites created to target MSI Afterburner. In the last three months, we Identified approximately 50 phishing websites targeting MSI Afterburner to deliver malware on the user’s machine. The figure below shows the phishing website created by TAs.įigure 1 – Phishing page downloading malicious MSI Afterburner installer By bundling a coin-miner into the tools such as Afterburner and installing it in the user’s machine, the TAs can hijack the processing power of the victim’s machine to mine the cryptocurrencies without their consent.
The TA hosted a phishing site to deliver the payload of coin-miner malware bundled with legitimate MSI Afterburner installers.Ĭrypto mining is a power and resource-intensive activity that requires dedicated hardware like GPUs. The TAs behind these campaigns used sophisticated phishing pages that mimic the legitimate MSI Afterburner site to lure the users into downloading coin-miner malware that performs the crypto-mining process. Recently, Cyble Research & Intelligence Labs (CRIL) identified several phishing campaigns targeting MSI Afterburner software to deliver coin-miner malware. Threat Actors (TAs) generally target these software tools to deliver malware to the user’s machine. Gamers and other high-performance computing users use various utility software tools such as MSI Afterburner, which monitors system performance and allows users to modify the hardware settings to enhance the system’s performance. Stealthy Miner Bypasses Detection Using Shellcode and Process Injection
0 kommentar(er)
