Cyble – New Malware Campaign Targets Zoom Users

MITRE Techniques

• [T1566] Phishing – The fake Zoom sites are created to spread malware disguised as the legitimate Zoom application. Quote: “the creation of multiple fake Zoom sites… spreading malware disguised as the legitimate Zoom application.”
• [T1204] User Execution – The campaign involves executing the downloaded payload which then drops binaries. Quote: “Upon execution, the malicious application drops two binaries in the temporary folder.”
• [T1555] Credentials from Password Stores – Vidar steals banking information, saved passwords, and login credentials. Quote: “Vidar is an Information Stealing malware that steals the victim’s banking information, saved passwords, IP addresses, browser history, login credentials, and crypto-wallets.”
• [T1539] Steal Web Session Cookie – Vidar’s credential theft capabilities include browser data and credentials. Quote: “steals the victim’s banking information, saved passwords, IP addresses, browser history, login credentials, and crypto-wallets.”
• [T1095] Non-Application Layer Protocol – The malware exchanges data with C2 servers for configuration and DLLs. Quote: “The malware receives the configuration data and DLLs from the C&C servers at this stage.”
• [T1041] Exfiltration Over C&C Channel – The campaign uses C2 channels to transfer configuration data and maintain control. Quote: “The figure below displays the network activity with the C&C server.”