cyber.hendryadrian.com
Threat Research · darktrace.com

Fake Startups Use Social Media to Spread Crypto-Stealing Malware

· Original article ↗

Summary

Darktrace details an ongoing scam in which fake software startups use social media to persuade targets to install Windows or macOS malware that steals cryptocurrency-related data and other information.

Key points

  • Threat actors pose as startups and use compromised or deceptive X accounts, websites, and content on Medium, GitHub, and Notion to appear legitimate.
  • Targets are contacted through X, Telegram, or Discord and offered cryptocurrency to test software; a registration code leads them to download a binary.
  • The Windows Electron app profiles the system and can retrieve and quietly execute an executable or MSI. Darktrace's observed verification did not succeed, so execution of the later payload was not confirmed in that analysis.
  • The macOS SwoxApp sample is Atomic Stealer, which targets browser data, crypto wallets, cookies, and documents, and uses anti-analysis checks.
  • A related macOS component sets up Launch Agent persistence and collects active-application and user-interaction information.
  • Darktrace lists numerous fake company names, domains, sample hashes, network indicators, and a YARA rule for detecting suspicious Electron installers.
  • Darktrace says attribution to the CrazyEvil traffer group is unclear, although the campaign's techniques are similar to those associated with the group.

Article Details

Attack Vectors
  • Fake startup companies use social engineering through X, Telegram, and Discord to persuade victims to download software in exchange for cryptocurrency payment.
  • Victims are directed to fake company download pages and given a registration code to download a Windows Electron application or macOS DMG.
  • The macOS DMG contains an obfuscated Bash script and a multiarchitecture binary; the script launches Atomic Stealer and installs persistence through a LaunchAgent.
  • The Windows application profiles the system and, if verification succeeds, quietly downloads and executes an executable or MSI. The article says this step did not succeed in the observed analysis; victim reports and prior campaigns indicate an information stealer may execute at this stage.
  • Atomic Stealer collects browser data, crypto wallets, cookies, and documents, compresses the data, and sends it to a remote endpoint. A separate binary logs application usage and user interaction data and transmits it periodically.
  • The operators use compromised or deceptive social media accounts, fake company websites and materials, and stolen code-signing certificates to make the operation appear legitimate and evade detection.

Indicators of compromise

TypeIndicatorContext
DOMAINaceartist[.]comDomain listed in the article's Indicators of Compromise section for the scam.
DOMAINbeesync[.]aiWebsite listed for the fake BeeSync company used in the scam.
DOMAINbeesync[.]ccWebsite listed for the fake BeeSync company used in the scam.
DOMAINbigpinellas[.]comDomain listed in the article's Indicators of Compromise section for the scam.
DOMAINbuzzu[.]appWebsite listed for the fake Buzzu company used in the scam.
DOMAINbuzzu[.]meWebsite listed for the fake Buzzu company used in the scam.
DOMAINbuzzu[.]spaceWebsite listed for the fake Buzzu company used in the scam.
DOMAINbuzzu[.]usWebsite listed for the fake Buzzu company used in the scam.
DOMAINconceptwo[.]comDomain listed in the article's Indicators of Compromise section for the scam.
DOMAINdexis[.]appWebsite listed for the fake Dexis company used in the scam.
DOMAINdsandbox[.]comDomain listed in the article's Indicators of Compromise section for the scam.
DOMAINekodirect[.]comDomain listed in the article's Indicators of Compromise section for the scam.
DOMAINeternal-decay[.]xyzWebsite listed for the fake Eternal Decay company used in the scam.
DOMAINlunelior[.]appWebsite listed for the fake Lunelior company used in the scam.
DOMAINlunelior[.]ioWebsite listed for the fake Lunelior company used in the scam.
DOMAINlunelior[.]netWebsite listed for the fake Lunelior company used in the scam.
DOMAINlunelior[.]usWebsite listed for the fake Lunelior company used in the scam.
DOMAINmanboon[.]comDomain listed in the article's Indicators of Compromise section for the scam.
DOMAINnexloop[.]meWebsite listed for the fake NexLoop company used in the scam.
DOMAINnexvoo[.]appWebsite listed for the fake NexVoo company used in the scam.
DOMAINnexvoo[.]netWebsite listed for the fake NexVoo company used in the scam.
DOMAINnexvoo[.]usWebsite listed for the fake NexVoo company used in the scam.
DOMAINpollens[.]appWebsite listed for the fake Pollens AI company used in the scam.
DOMAINpollens[.]ioWebsite listed for the fake Pollens AI company used in the scam.
DOMAINpollens[.]techWebsite listed for the fake Pollens AI company used in the scam.
DOMAINslax[.]ccWebsite listed for the fake Slax company used in the scam.
DOMAINslax[.]socialWebsite listed for the fake Slax company used in the scam.
DOMAINslax[.]techWebsite listed for the fake Slax company used in the scam.
DOMAINslaxai[.]appWebsite listed for the fake Slax company used in the scam.
DOMAINsolune[.]ioWebsite listed for the fake Solune company used in the scam.
DOMAINsolune[.]meWebsite listed for the fake Solune company used in the scam.
DOMAINswox[.]appWebsite listed for the fake Swox company used in the scam.
DOMAINswox[.]ccWebsite listed for the fake Swox company used in the scam.
DOMAINswox[.]ioWebsite listed for the fake Swox company used in the scam.
DOMAINswox[.]usWebsite listed for the fake Swox company used in the scam.
DOMAINswoxai[.]comWebsite listed for the fake Swox company used in the scam.
DOMAINtroveur[.]comDomain listed in the article's Indicators of Compromise section for the scam.
DOMAINturismoelcasco[.]comDomain listed in the article's Indicators of Compromise section for the scam.
DOMAINwasper[.]appWebsite listed for the fake Wasper company used in the scam.
DOMAINwasper[.]orgWebsite listed for the fake Wasper company used in the scam.
DOMAINwasper[.]proWebsite listed for the fake Wasper company used in the scam.
DOMAINwasper[.]spaceWebsite listed for the fake Wasper company used in the scam.
DOMAINyonda[.]usWebsite listed for the fake YondaAI company used in the scam.
IPV477[.]73[.]129[.]18Server from which an additional Bash script is retrieved; the article specifies port 80.
MD502a5b35be82c59c55322d2800b0b8cccHash listed as the Windows artifact for the fake Pollens AI company.
MD522b2ea96be9d65006148ecbb6979ecccHash listed as the Windows artifact for the fake Solune company.
MD53a3b13de4406d1ac13861018d74bf4b2Hash listed as the Windows artifact for the fake Cloudsign company.
MD5558889183097d9a991cb2c71b7da3c51Hash listed as the Windows artifact for the fake Eternal Decay company.
MD574654e6e5f57a028ee70f015ef3a44a4Hash listed as the Windows artifact for the fake Lunelior company.
MD57d70a7e5661f9593568c64938e06a11aHash listed as the Windows artifact for the fake Buzzu company.
MD5a4786af0c4ffc84ff193ff2ecbb564b8Hash listed as the macOS artifact for the fake Eternal Decay company.
MD5be0e3e1e9a3fda76a77e8c5743dd2cedHash listed as the macOS artifact for the fake Buzzu company.
MD5d50393ba7d63e92d23ec7d15716c7be6Hash listed as the Windows artifact for the fake Swox company.
MD5d723162f9197f7a548ca94802df74101Hash listed as the macOS artifact for the fake Lunelior company.
SHA25681996a20cfa56077a3bb69487cc58405ced79629d0c09c94fb21ba7e5f1a24c9Hash listed as the macOS artifact for the fake Swox company.
URLhxxp[:]//45[.]94[.]47[.]112/contactURL listed in the article's Indicators of Compromise section for the scam.
URLhxxps[:]//gaetanorealty[.]comURL listed in the article's Indicators of Compromise section for the scam.
URLhxxps[:]//isnimitz[.]com/zxc/app[.]zipURL listed in the article's Indicators of Compromise section for the scam.
URLhxxps[:]//mrajhhosdoahjsd[.]comServer URL from which the campaign's install script retrieves another script.
URLhxxps[:]//mrajhhoshoahjsd[.]com/collect-metricsEndpoint receiving periodically transmitted application-usage and user-interaction logs.

MITRE ATT&CK

T1005 · Data from Local SystemAtomic Stealer collects browser data, crypto wallets, cookies, and documents from the system.T1027 · Obfuscated Files or InformationThe macOS Bash script is obfuscated with junk data, base64, and XOR.T1041 · Exfiltration Over C2 ChannelAtomic Stealer sends collected data to a remote endpoint in a POST request; the InstallerHelper binary also periodically transmits collected logs.T1059.004 · Unix ShellThe macOS DMG contains a Bash script that moves the hidden binary to /tmp and makes it executable.T1082 · System Information DiscoveryThe Windows application profiles the system, collecting operating-system and hardware details including CPU, RAM, MAC address, graphics card, and UUID.T1105 · Ingress Tool TransferThe Windows application retrieves an executable or MSI, Python is retrieved separately, and the macOS scripts retrieve additional scripts and a binary.T1497.001 · System ChecksAtomic Stealer checks for QEMU, VMWare, and Docker-OSX and exits if those analysis environments are detected.T1547.011 · Plist ModificationA retrieved macOS script establishes persistence through a LaunchAgent configured to run at login.

Threat Actors

CrazyEvilA prominent traffer group reported by Recorded Future; the article says attribution of the campaigns described to CrazyEvil or its subteams is unclear, although the techniques are similar.

Malware

Atomic StealerThis type of AppleScript is commonly used in macOS malware, such as Atomic Stealer.Realstup meeting software companies to trick users into joining meetings and installing the information stealer Realst disguised as video meeting software.

Vendors

DarktraceContinued research by Darktrace has revealed that cryptocurrency users are being targeted by threat actors in an elaborate social engineering scheme that continues to evolve. In December 2024, Cado Security Labs

Products

Electronoperating system, the victim will be instructed to download a macOS DMG (if available) or a Windows Electron application.macOSWindows and macOS versions.Microsoft WindowsWindows and macOS versions.

Tools

PythonPython is also retrieved and stored in /AppData/Temp, with Python commands being sent from the command-and-control (C2) infrastructure.

Industries

CryptocurrencyContinued research by Darktrace has revealed that cryptocurrency users are being targeted by threat actors in an elaborate social engineering scheme that continues to evolve. In December 2024, Cado Security LabsGamingThreat actors creating fake startup companies with AI, gaming, video meeting software, web3 and social media themes.

Related Articles