Boss Scam Malware Uses DLL Sideloading to Target WhatsApp Web Sessions
Summary
K7 analysis describes Boss Scam lures that deliver a signed executable and malicious DLL, which sideloads malware to persist, collect Chromium browser artifacts, and send them over TCP—potentially enabling WhatsApp Web session hijacking and internal impersonation.
Key points
- Lures impersonate trusted contacts or organizations, including the Reserve Bank of India and the Tax Department, and deliver a ZIP attachment or download link.
- The ZIP contains a signed executable that loads a malicious DLL from the same directory through DLL sideloading.
- The malware can create Registry Run entries, copy itself to %AppData% or %ProgramData%, and, in some variants, use Dynamic API Resolution or take screenshots.
- It searches Chrome and Edge for active WhatsApp Web sessions and collects browser data such as cookies, tokens, encryption material, saved credentials, and autofill information.
- The malware archives collected data with Windows tar.exe and sends it to the attacker over TCP; the article says this could enable session hijacking and impersonation.
- The article recommends verifying urgent requests, avoiding unexpected attachments, reviewing linked WhatsApp devices, and revoking exposed sessions and credentials.
Article Details
- Attack Vectors
- Email or WhatsApp messages impersonate trusted contacts and deliver ZIP attachments or links to ZIP downloads.
- A legitimate signed executable sideloads a malicious DLL from its directory.
- The malware establishes persistence with Registry Run entries, searches Chrome and Edge for active WhatsApp Web sessions, and collects browser artifacts.
- Collected data is archived with tar.exe and sent to the attacker over TCP; stolen session artifacts may enable account impersonation and further internal lures.
- Defensive Notes
- Verify unexpected urgent requests through a separate trusted channel, and do not run files received through email or messaging apps unless verified.
- Treat unexpected password-protected ZIP attachments as suspicious; configure Windows to display file extensions.
- Avoid unnecessary browser sessions, enable MFA where available, and keep antivirus or endpoint protection updated.
- If compromised, scan and quarantine suspicious files, review Registry Run keys and Task Scheduler, terminate unused WhatsApp Web linked devices, rotate saved passwords, revoke sessions, and notify IT and affected contacts.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| MD5 | 91c8497847ff6aafe365ae731e76f031 | Hash listed for the malicious libfabric.dll. |
| MD5 | aaefaa9844410991bddae304b93673c6 | Hash listed for the malicious libfabric.dll. |
| URL | hxxps[:]//zusyyredrs[.]love/ | Identified as the malicious attachment-delivery URL. |
MITRE ATT&CK
T1005 · Data from Local SystemThe malware collects local browser files, including cookies, IndexedDB, Login Data, and Web Data.T1074.001 · Local Data StagingCollected browser data is staged in an archive before it is sent to the attacker.T1113 · Screen CaptureSome variants take screenshots and send them to the attacker.T1539 · Steal Web Session CookieThe malware collects browser cookies and session artifacts that may enable session hijacking.T1547.001 · Registry Run Keys / Startup FolderThe malware creates Registry Run entries to execute at user logon.T1555.003 · Credentials from Web BrowsersThe malware collects browser Login Data containing saved usernames and passwords.T1560.001 · Archive via UtilityThe malware uses tar.exe to archive collected browser data.T1566.001 · Spearphishing AttachmentThe lures deliver ZIP attachments by email or WhatsApp, including messages impersonating trusted contacts.T1566.002 · Spearphishing LinkSome lures include a clickable link that downloads the malicious ZIP archive.T1574.002 · DLL Side-LoadingA legitimate signed executable loads a malicious DLL from its current directory.
Products
Google ChromeIt runs in the background till it finds an active WhatsApp Web session in Chromium-based browsers such as Google Chrome and Microsoft Edge.K7 AntivirusUse a good Antivirus Product like K7 Antivirus.Microsoft EdgeIt runs in the background till it finds an active WhatsApp Web session in Chromium-based browsers such as Google Chrome and Microsoft Edge.Microsoft Windows[T1218 ] System Binary Proxy Execution – The malware abuses a trusted Windows utility to stage or move stolen data, reducing suspicion and helping evade security tools (‘the malware abuses this built-in Windows utilityWhatsApp WebThis Boss Scam campaign abuses WhatsApp Web trust by delivering ZIP archives that hide a signed executable and a malicious DLL, enabling DLL sideloading, persistence, session theft, and data exfiltration.