Welcome to the May 2023 edition of our monthly malware analysis news report.
<\/p>\n\n\n\n
We\u2019ve gathered some of the most important cybersecurity events that transpired over the past month. Read on to make sure you\u2019re not missing any emerging threats. <\/p>\n\n\n\n
The QBot<\/strong> malware operation has begun<\/a> exploiting a DLL hijacking vulnerability in the Windows 10 WordPad program (write.exe) to infiltrate computers. <\/p>\n\n\n\n This technique, known as DLL hijacking, leverages the way Windows applications load DLL files, allowing a malicious DLL to be loaded instead of a legitimate one when the application is launched. QBot<\/a> is primarily spread through phishing campaigns that include a link to download a file. This file, when downloaded and executed, initiates the infection. <\/p>\n\n\n\n While QBot initially started as a banking Trojan, it has since evolved into a dropper for other types of malware, working with ransomware groups to compromise corporate networks. The malware also steals emails for use in further phishing attacks <\/p>\n\n\n\n A new campaign involving the Batloader <\/strong>malware is using Google Search advertisements for the ChatGPT and Midjourney generative AI services to distribute the RedLine stealer. <\/p>\n\n\n\n The fraudulent ads misdirect users to webpages, which allow the installation of ChatGPT or Midjourney executables bundled with a PowerShell script. This script facilitates RedLine stealer downloads, while its malicious activity remains undetected due to the binary’s use of Microsoft Edge WebView2. <\/p>\n\n\n\n This new method shows the evolving tactics of cybercriminals. Previous reports identified BATLOADER used in campaigns with ChatGPT lures for Vidar Stealer<\/a> and Ursnif<\/a> malware distribution. Furthermore, an increase in ChatGPT-related domain registrations has been noted, highlighting the need for heightened cybersecurity vigilance.\u00a0<\/p>\n\n\n\n\n2. Batloader Campaign Utilizes AI Ads to Distribute RedLine Stealer <\/h2>\n\n\n\n