Proofpoint researchers describe a social-engineered technique where users are prompted to copy-paste PowerShell scripts to install malware, used by TA571 and the ClearFake cluster to deliver DarkGate, Matanbuchus, NetSupport, Lumma Stealer, and other payloads. The attack chain relies on fake warnings or updates and clipboard-based multi-stage PowerShell scripts to install malware. #TA571 #DarkGate #Matanbuchus #NetSupport #LummaStealer #ClearFake
Keypoints
- TA571 and the ClearFake cluster use social engineering that tricks users into copying and pasting PowerShell commands to trigger malware installations.
- Attackers present fake warnings/overlays on compromised sites or documents to drive clipboard-based execution of PowerShell code.
- The PowerShell chain is multi-stage: a script downloads and executes additional PowerShell scripts in memory, culminating in payloads.
- ZIP bundles containing legitimate signed executables are used to side-load a trojanized DLL (DOILoader) to run Lumma Stealer and other payloads.
- Lumma Stealer downloads additional payloads (e.g., Amadey Loader, XMRig miner, clipboard hijacker) and performs clipboard manipulation to steal funds.
- In some campaigns, environment checks (like WMI temperature) determine if the target is a sandbox or physical host before continuing.
- Defense guidance emphasizes user training to recognize these lures and the availability of Emerging Threats detections for this activity.
MITRE Techniques
- [T1566.001] Phishing – Spearphishing via Email Attachment – The TA571 campaigns used HTML attachments that displayed a faux Word page and included instructions to copy/paste PowerShell to install malware. “HTML attachment containing instructions on how to copy and paste PowerShell that leads to the installation of malware.”
- [T1059.001] PowerShell – Command and Scripting Interpreter – The threat chain relies on PowerShell execution, with users instructed to open PowerShell and paste code from the clipboard. “open a PowerShell terminal and right-click to paste the console window.”
- [T1115] Clipboard Data – Clipboard Hijacking – The malicious content is copied to the clipboard via browser-side JavaScript, and a base64-encoded PowerShell command is copied to the clipboard. “copied a base64-encoded PowerShell command to the computer’s clipboard.”
- [T1105] Ingress Tool Transfer – Downloading additional payloads over the network – The second PowerShell script downloads yet another PowerShell script and a remote payload. “The second PowerShell script was essentially used to download yet another PowerShell script.” and “download a remote PowerShell script and execute it in-memory.”
- [T1574.001] Hijack Execution Flow: DLL Side-Loading – Bundling legitimate signed executables in a ZIP to side-load a trojanized DLL (DOILoader) to load Lumma Stealer. “bundled various legitimate, signed executables that side-loaded a trojanized DLL.”
- [T1027] Obfuscated/Compressed Files and Information – AES-encrypted PowerShell scripts and payloads used in the chain. “AES-encrypted PowerShell script” and the extraction of data.zip to execute files.
- [T1036] Masquerading – The use of fake warnings/updates and legitimate-looking overlays to trick users into running malicious code. “fake browser update” overlays and warnings that appear authoritative.
Indicators of Compromise
- [Email] TA571 campaign reply-to email – rechtsanwalt@ra-silberkuhl[.]com
- [Hash] TA571 HTML Attachment Example Hash – 9701fec71e5bbec912f69c8ed63ffb6dba21b9cca7e67da5d60a72139c1795d1
- [URL] TA571 HTML attachment payloads – hxxps://cdn3535[.]shop/1[.]zip, hxxps://kostumn1[.]ilabserver[.]com/1.zip
- [URL] TA571 PowerShell payload URLs – hxxp://languangjob[.]com/pandstvx, hxxp://languangjob[.]com/pandstvx, hxxps://jenniferwelsh[.]com/header.png
- [IP] TA571 C2 / payload host – 91.222.173[.]113
- [Hash] CopyFix PowerShell Payload URL – 11909c0262563f29d28312baffb7ff027f113512c5a76bab7c5870f348ff778f
- [File] Data ZIP payload – data.zip
Read more: https://www.proofpoint.com/us/blog/threat-insight/clipboard-compromise-powershell-self-pwn