More than 1,300 domains have been leveraged in an ongoing widespread AnyDesk impersonation campaign aimed at distributing the Vidar information-stealing malware, BleepingComputer reports.
Identified by SEKOIA threat analyst crep1x, the AnyDesk campaign involves various malicious hostnames including typosquats for AnyDesk, Slack, VLC, 7-ZIP, and other apps all of which resolve to the 185.149.120[.]9 IP address and redirect to a site cloning AnyDesk.
All of the sites were deploying a file purporting to be an AnyDesk installer with the name "AnyDeskDownload.zip" that actually installs the Vidar stealer, which does not only target browser history and account credentials, but also saved passwords, cryptocurrency wallet data, and banking details.
Attackers behind the latest campaign have leveraged Dropbox to facilitate payload delivery rather than depend on redirections to bypass detection.
Vidar was recently observed by BleepingComputer to have been deployed in a separate campaign with more than 200 typosquatting domains masquerading 27 software brands.
Included in the exposed dataset labeled "PDL" were individuals' full names, email addresses, phone numbers, location data, professional summaries, and skills, as well as education and employment histories.
Attackers could leverage the issue — which impacts Nexus 3000, 7000, and 9000 series switches with vulnerable NX-OS versions with DHCPv6 activated and are in standalone NX-OS mode — to facilitate continuous crashes of the dhcp_snoop process and a denial-of-service condition.
Higher rewards of up to $250,000 will be given by Google for the discovery of memory corruption flaws in the Chrome browser shown to achieve remote code execution using a non-sandboxed process as part of a more robust vulnerability reward program.