Be careful. Fake Microsoft alert.

Users beware of fake Microsoft alerts, believe they may be infected with malware imports from North Korea.

According to a report by the website, The Hacker News mentioned the detection of a new campaign of hackers sponsored by the North Korean government, ScarCruft, with a specific spear-phishing campaign, by sending an account security alert from Microsoft Account to trick the victim into installing a malware type that remotely controls the victim's system (RAT or Remote Access Trojan) named NarwhalRAT. This malware has the ability to smuggle a variety of data, including Keylogging, Screenshot, Data from USB drives, Ups. Load folders, secretly store Windows data, and run Instruction commands sent from the C2 or Command and Control server. The malware name comes from a secret folder called "% APPDATA% naverwhale," which the malware uses to collect data to secretly export it to hackers. This name is imitated from the Naver (LINE's parent company) web browser called Naver Whale.

As for the scam, hackers send emails that are slick to Microsoft Account, alerting victims that there is an unusual activity in accessing an account from repeatedly creating an OTP or One-Time Password, along with an attachment that claims to be a guide to dealing with the problem, but it is in fact a genus compressed file. Zip with an Internet Shortcut file of the LNK genus hidden inside. If the victim opens it, it will lead to the installation of Multi-Stages Infection. At the same time, it downloads the Python tool file from the official website, along with the CAT file (Windows security catalog) that pulls Fetch, the malware file (Payload) from the C2 server, and runs the tool. After the malware has installed itself, it will create stability on the system by scheduling a task called " MicrosoftUserInterfacePicturesUpdateTackMachine "and" MicrosoftMusicLibrariesPackageTaskMachine "by these Tasks would be the use of such CAT files to pull the Payload down on the machine one more time.

# Trending # lemon 8 diary # Microsoft # Malware # freedomhack