Google ads push malicious CPU-Z app from fake Windows news site

Trojanized CPU-Z app on fake Windows news site pushed by Google

A threat actor has been abusing Google Ads to distribute a trojanized version of the CPU-Z tool to deliver the Redline info-stealing malware.

The new campaign was spotted by Malwarebytes analysts who, based on the backing infrastructure, asses that it is part of the same operation that used Notepad++ malvertising to deliver malicious payloads.

Campaign details

The malicious Google advertisement for the trojanized CPU-Z, a tool that profiles computer hardware on Windows, is hosted on a cloned copy of the legitimate Windows news site WindowsReport.

CPU-Z is a popular free utility that can help users monitor different hardware components, from fan speeds, to CPU clock rates, voltage, and cache details.

The malicious Google Ad
The malicious Google Ad (Malwarebytes)

Clicking the ad takes the victim through a redirect step that tricks Google’s anti-abuse crawlers by sending invalid visitors to an innocuous site.

Those deemed valid to receive the payload are redirected to a Windows news site lookalike hosted on one of the following domains:

  • argenferia[.]com
  • realvnc[.]pro
  • corporatecomf[.]online
  • cilrix-corp[.]pro
  • thecoopmodel[.]com
  • winscp-apps[.]online
  • wireshark-app[.]online
  • cilrix-corporate[.]online
  • workspace-app[.]online
Redirection steps
Redirection steps (Malwarebytes)

The reason behind using a clone of a legitimate site is to add another layer of trust to the infection process, as users are familiar with tech news sites hosting download links for useful utilities.

Comparison between the real and the fake site
Comparison between the real and the fake site (Malwarebytes)

Clicking on the ‘Download now’ button results in receiving a digitally-signed CPU-Z installer (MSI file) containing a malicious PowerShell script identified as the ‘FakeBat’ malware loader.

Signed installer file
Digitally signed installer file (Malwarebytes)

Signing the file with a valid certificate makes it unlikely that Windows security tools or third-party antivirus products running on the device will serve a warning for the user.

The loader fetches a Redline Stealer payload from a remote URL and launches it on the victim’s computer.

PowerShell downloading the final payload
PowerShell downloading the final payload on the host (Malwarebytes)

Redline is a powerful stealer able to collect passwords, cookies, and browsing data from a range of web browsers and applications, as well as sensitive data from cryptocurrency wallets.

To minimize the chances of malware infections when looking for specific software tools, users should pay attention when clicking on promoted results in Google Search and check the if the loaded site and the domain match, or use an ad-blocker that hides them automatically.

Original Source

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on “Patreon” or “Buy Me A Coffee” using the buttons below

 To keep up to date follow us on the below channels.