Trojanized Google Antigravity Installer Can Deploy Credential-Stealing Malware
Summary
A trojanized Antigravity installer from a lookalike site runs a PowerShell downloader that checks in to opus-dsn[.]com. Researchers found the operator can selectively deploy a .NET stealer targeting credentials, cookies and tokens.
Key points
- The repackaged installer adds an MSI custom action that drops PowerShell scripts; one script contacts opus-dsn[.]com for follow-on code.
- The initial check-in does not necessarily install further malware; the operator can decide whether to send a payload to a particular machine.
- Researchers retrieved follow-on code that can disable Defender and AMSI, collect a machine profile, and stage encrypted payloads from captr.b-cdn[.]net.
- A scheduled task disguised as a Microsoft Edge update can persist an encrypted .NET assembly, which is decrypted and loaded in memory.
- The analyzed stealer targets browser passwords, cookies and autofill data, as well as messaging, gaming, FTP and cryptocurrency data; it also includes keylogging and clipboard-hijacking capabilities.
- The article recommends checking logs for google-antigravity[.]com, opus-dsn[.]com, captr.b-cdn[.]net or 89[.]124[.]96[.]27, then securing accounts and credentials from a clean device and reinstalling Windows.
Article Details
- Attack Vectors
- A trojanized Antigravity installer was distributed from the typosquat domain google-antigravity[.]com. It installed the legitimate application while adding an MSI custom action that ran an attacker-added PowerShell script.
- The PowerShell downloader contacted the operator-controlled server over HTTPS and could retrieve and execute follow-on code. The operator could decide whether to escalate on an individual machine.
- When activated, follow-on code weakened Defender and AMSI protections, collected and transmitted a machine profile, and downloaded encrypted payloads disguised as image and XML files.
- A scheduled task established persistence by launching hidden PowerShell to decrypt and reflectively load a .NET assembly in memory. The stealer targeted browser credentials, cookies, autofill data, messaging and gaming tokens, FTP credentials, and cryptocurrency wallet files.
- Defensive Notes
- Search firewall, EDR, and router logs for connections to opus-dsn[.]com, captr.b-cdn[.]net, or 89[.]124[.]96[.]27; the article says a PowerShell connection can confirm that the check-in occurred.
- From a clean device, sign out of active sessions and change important account passwords, starting with email. Rotate API keys, SSH keys, and cloud credentials that were on the affected machine.
- Move cryptocurrency funds from a clean device, monitor bank and credit-card statements, and wipe and reinstall Windows on affected machines.
- Notify IT or the security team if a work device may be affected; the beacon collects the machine's Active Directory domain.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | google-antigravity[.]com | Typosquat domain used to distribute the trojanized Antigravity installer. |
| IPV4 | 89[.]124[.]96[.]27 | C2 server IP address contacted over port 443 by the downloader. |
| SHA256 | 61aca585687ec21a182342a40de3eaa12d3fc0d92577456cae0df37c3ed28e99 | SHA-256 hash of the trojanized Antigravity_v1.22.2.0.exe installer. |
| URL | hxxps[:]//captr[.]b-cdn[.]net/secret.png | Specific CDN-hosted URL used to download the encrypted payload disguised as secret.png. |
| URL | hxxps[:]//opus-dsn[.]com/login/ | HTTPS command-and-control endpoint contacted by the PowerShell downloader to retrieve and execute follow-on code. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe operation uses obfuscated command text and encrypted payloads to conceal its actions and code.T1041 · Exfiltration Over C2 ChannelThe follow-on code sends an encrypted machine profile to the operator, and the stealer exfiltrates collected credentials and other data.T1053.005 · Scheduled TaskThe payload registers a scheduled task named to resemble a Microsoft Edge update task and runs it at logon.T1056.001 · KeyloggingThe malware includes keystroke-logging capability.T1059.001 · PowerShellThe MSI custom action and downloader cradle use PowerShell scripts to retrieve and run follow-on code.T1071.001 · Web ProtocolsThe downloader communicates with opus-dsn[.]com over HTTPS for check-in and payload retrieval.T1082 · System Information DiscoveryThe follow-on script collects machine information, including the Windows version.T1105 · Ingress Tool TransferThe operation downloads encrypted payload files, including secret.png and GGn.xml, from the CDN host.T1113 · Screen CaptureThe article describes hidden-desktop capabilities that can capture the hidden desktop.T1115 · Clipboard DataThe malware includes clipboard-hijacking capability, including swapping cryptocurrency wallet addresses.T1539 · Steal Web Session CookieThe stealer collects browser session cookies that can be used to access signed-in accounts.T1555.003 · Credentials from Web BrowsersThe stealer collects saved logins, cookies, and autofill data from Chromium- and Firefox-based browsers.T1562.001 · Disable or Modify ToolsFollow-on code adds Defender exclusions and sets AmsiEnable=0 to disable AMSI scanning.T1620 · Reflective Code LoadingThe malware decrypts payloads in memory and reflectively loads .NET assemblies into a process.
Vendors
GoogleA trojanized Antigravity installer downloaded from a typosquat domain (google-antigravity[.]com) ran a single malicious MSI custom-action that dropped PowerShell downloader scripts which checked in to opus-dsn[.]com andMicrosoft[T1053.005 ] Scheduled Task/Job – Persistence is achieved by creating a scheduled task named to resemble Microsoft Edge update that runs at logon to load the payload (‘registered with the name
Products
AntigravityA trojanized Antigravity installer downloaded from a typosquat domain (google-antigravity[.]com) ran a single malicious MSI custom-action that dropped PowerShell downloader scripts which checked in to opus-dsn[.]com andDefenderWhen activated, the follow-on payloads disabled Defender/AMSI, staged an encrypted .NET stealer via a fake MicrosoftEdgeUpdate.png delivered from captr.b-cdn[.]net, persisted via a scheduled task, and exfiltratedMicrosoft Windowsand change email-first passwords; rotate keys and move crypto from a clean device; wipe and reinstall Windows and notify IT if corporate.