A malvertising campaign hijacks photography-related social media pages, renames them to resemble a popular AI photo editor, and pushes links to fake sites to steal admin credentials. The attackers deploy an endpoint-management tool (ITarian) as a faux photo editor to install Lumma Stealer and exfiltrate sensitive data. #LummaStealer #ITarian #Evoto #TrendMicro #Malvertising
Keypoints
- Threat actors hijack photography-related social media pages and rename them to resemble Evoto AI photo editor.
- Malicious posts are boosted with paid ads to drive traffic to fake websites.
- Phishing messages steal admin credentials via personalized links leading to fake account protection pages.
- Users are tricked into downloading an endpoint management utility (ITarian) disguised as a photo editor.
- ITarian enrollment enables remote control and deployment of payloads like Lumma Stealer, exfiltrating crypto wallets, browser data, and passwords.
- Lumma Stealer communicates via encoded C2 traffic and loads a decrypted, configurable payload to harvest data.
- Security recommendations emphasize MFA, phishing awareness, account monitoring, and defense-in-depth with Trend Micro tools.
MITRE Techniques
- [T1566.002] Phishing: Spearphishing Link – Used to steal credentials through deceptive links. Quote: “The attackers use spam messages with phishing links to steal admin credentials.”
- [T1586.001] Compromise Accounts: Social Media Accounts – Hijacking social media accounts for malicious purposes. Quote: “Hijacking social media accounts for malicious purposes.”
- [T1204] User Execution – Victims execute malicious software thinking it’s legitimate. Quote: “Victims execute malicious software thinking it’s legitimate.”
- [T1140] Deobfuscate/Decode Files or Information – Used to decode malicious scripts or payloads. Quote: “Used to decode malicious scripts or payloads.”
- [T1562] Impair Defenses – Disabling security features to facilitate attacks. Quote: “Disabling security features to facilitate attacks.”
- [T1027] Obfuscated Files or Information – Using obfuscation to hide malicious code. Quote: “Using obfuscation to hide malicious code.”
- [T1056] Credential Access – Techniques used to capture user credentials. Quote: “Techniques used to capture user credentials.”
- [T1003] OS Credential Dumping – Extracting credentials from the operating system. Quote: “Extracting credentials from the operating system.”
- [T1083] File and Directory Discovery – Searching for files and directories to target. Quote: “Searching for files and directories to target.”
- [T1082] System Information Discovery – Gathering information about the system for further exploitation. Quote: “Gathering information about the system for further exploitation.”
- [T1217] Browser Information Discovery – Collecting data from web browsers for credential theft. Quote: “Collecting data from web browsers for credential theft.”
- [T1560] Archive Collected Data – Compiling stolen data for exfiltration. Quote: “Compiling stolen data for exfiltration.”
- [T1119] Automated Collection – Automatically gathering sensitive data from the system. Quote: “Automatically gathering sensitive data from the system.”
- [T1005] Data from Local System – Collecting data stored locally on the victim’s device. Quote: “Collecting data stored locally on the victim’s device.”
- [T1056] Input Capture – Capturing user input to steal sensitive information. Quote: “Capturing user input to steal sensitive information.”
- [T1132] Data Encoding – Encoding data to evade detection during exfiltration. Quote: “Encoding data to evade detection during exfiltration.”
- [T1001] Data Obfuscation – Hiding the nature of the data being exfiltrated. Quote: “Hiding the nature of the data being exfiltrated.”
- [T1573] Encrypted Channel – Using encryption for command and control communications. Quote: “Using encryption for command and control communications.”
- [T1219] Remote Access Software – Utilizing remote access tools for control over victim devices. Quote: “Utilizing remote access tools for control over victim devices.”
- [T1020] Automated Exfiltration – Automatically transferring stolen data to the attacker. Quote: “Automatically transferring stolen data to the attacker.”
- [T1041] Exfiltration Over C2 Channel – Sending stolen data through command and control channels. Quote: “Sending stolen data through command and control channels.”
- [T1657] Financial Theft – Stealing financial information or assets from victims. Quote: “Stealing financial information or assets from victims.”
Indicators of Compromise
- [URL] Context – phishing links used in the malvertising campaign; examples: linkup.top, bio.link (and 2 more items)
- [Domain] Context – domains used in the campaign; examples: evoto.ai, apple.com
- [File name] Context – installer and payloads; examples: em__installer.msi, lumma_stealer.bin
- [User Agent] Context – user agent used by downloader; example: “Magic Browser”
- [URL] Context – enrollment/config URLs; example: https://mdmsupport.comodo.com/enroll/resolve/token/
- [JSON] Config/Payload Context – decrypted Lumma Stealer config file; example: lumma-cfg-importancedopz.shop-beautified.json