McAfee customers utilizing Real Protect Cloud were proactively protected from this threat due to machine learning.Application profile data (Chrome, Exodus wallet, Ethereum wallet, Opera, Telegram Desktop).System information (Process list, Drive details, Serial number, RAM, Graphics card details).The shortcut points to the installed malware: C:\Program Files\WindowsApps\245d1cf3-25fc-4ce1-9a58-7cd13f94923a_1.0.0.0_neutral_7afzw0tp1da5e\bloom\Eversible.exe, which is a data stealing trojan, targeting various applications and information: When downloaded and run, the user is prompted to install a supposed Defender Update from “Publisher: Microsoft”Īfter installation, the “Defender Update” App appears in the start menu like other Windows Apps.
The site serves a signed ms-appinstaller (MSIX) package. A toaster popup in the tray informs the user of a Windows Defender Update.Ĭlicking the message takes the user to a fake update website. This recent example demonstrates the social engineering tactics used to trick users into installing a fake Windows Defender update. As recently discussed, scammers are abusing push notifications to trick users into taking action. Victims end up allowing the installation of a malicious Windows Application that targets user and system informationīrowser push notifications can highly resemble Windows system notifications.Recent campaigns pose as a Windows Defender Update.Scammers are increasingly using Windows Push Notifications to impersonate legitimate alerts.
0 kommentar(er)
