{"id":76833,"date":"2024-10-14T13:00:47","date_gmt":"2024-10-14T13:00:47","guid":{"rendered":"http:\/\/9a60eff34788bcc37f6f3af9073f3233"},"modified":"2024-10-14T13:00:47","modified_gmt":"2024-10-14T13:00:47","slug":"windows-users-are-being-tricked-by-sneaky-malware-scheme","status":"publish","type":"post","link":"https:\/\/wp.timesamerica.net\/windows-users-are-being-tricked-by-sneaky-malware-scheme\/","title":{"rendered":"Windows users are being tricked by sneaky malware scheme"},"content":{"rendered":"\n

Hackers continuously target Windows users by exploiting existing vulnerabilities or installing malware. Security experts found a new type of malware that spreads through fake human verification pages. The attackers set up phishing websites using different platforms, often relying on Content Delivery Networks. These sites trick users by showing a fake Google CAPTCHA page, which secretly installs malware known as Lumma Stealer.<\/p>\n

GET SECURITY ALERTS, EXPERT TIPS \u2013 SIGN UP FOR KURT\u2019S NEWSLETTER \u2013 THE CYBERGUY REPORT HERE<\/u><\/strong><\/span><\/p>\n

\n
\"Windows<\/picture><\/div>\n
\n
\n

A woman working on her Windows laptop<\/span> (Kurt “CyberGuy” Knutsson)<\/span><\/p>\n<\/div>\n<\/div>\n<\/div>\n

What you need to know<\/strong><\/h2>\n

Cloudsek researchers found<\/u><\/span> more details on a new, clever way hackers are spreading the Lumma Stealer malware. They\u2019re targeting Windows users with fake human verification pages. Palo Alto Networks\u2019 Unit 42 first reported these fake pages, pointing out how they\u2019re being used to spread malware.<\/p>\n

“These pages have a button that, when clicked, shows instructions for victims to paste PowerShell script into a Run window. This copy\/paste PowerShell script retrieves and runs a Windows EXE for Lumma Stealer malware,” Unit 42 threat hunter Paul Michaud II explained.<\/p>\n

The latest investigation by Cloudsek uncovers more active malicious sites spreading the Lumma Stealer. Researchers explained that when you click the “I\u2019m not a robot” button on the fake verification page, a PowerShell script is copied to your clipboard. If you paste this command into the Run dialog box, it triggers PowerShell in a hidden window and runs a Base64-encoded command. <\/p>\n

This command retrieves more instructions from a text file on a remote server, which then downloads the Lumma Stealer malware. If the downloaded file, named “dengo.zip,” is unzipped and run on a Windows computer, the Lumma Stealer becomes active, connecting to attacker-controlled domains. The researchers also mentioned that the malware delivered through this page can be easily switched out for other malicious files.<\/p>\n

\n
\"Windows<\/picture><\/div>\n
\n
\n

Malicious site spreading the Lumma Stealer (PAN Unit 42)<\/span> (Kurt “CyberGuy” Knutsson)<\/span><\/p>\n<\/div>\n<\/div>\n<\/div>\n

CYBERSCAMMERS USE AI TO MANIPULATE GOOGLE SEARCH RESULTS<\/u><\/strong><\/span><\/p>\n

Updating your PC is the best course of action<\/strong><\/h2>\n

Make sure your Windows system, browsers and antivirus software are regularly updated to protect against known vulnerabilities. Software updates often include patches for security vulnerabilities that hackers exploit. By keeping your operating system, browsers and apps up to date, you’re closing these gaps and making it harder for malware to get in. To update your Windows software and benefit from the latest security patches, follow these simple steps:<\/p>\n

For Windows 10 and Windows 11<\/strong><\/h3>\n