A recent investigation has revealed a large-scale #infostealer #malware operation linked to a cybercriminal group called "#MarkoPolo ," which has conducted over thirty campaigns targeting various demographics and systems. The operation utilizes multiple distribution methods, such as malvertising, spearphishing, and brand impersonation, focusing on sectors like online gaming, cryptocurrency, and software.
According to Recorded Future's Insikt Group, the Marko Polo campaign has likely compromised tens of thousands of devices globally, resulting in potential financial losses amounting to millions. The malware includes notable payloads like AMOS, Stealc, and Rhadamanthys, with reports indicating significant risks to consumer privacy and business continuity.
**Key Tactics Used by Marko Polo:**
1. #Spearphishing : Targeting high-value individuals such as cryptocurrency influencers and software developers through direct messages on social media, often luring them with fake job offers or project collaborations.
2. Brand Impersonation: Utilizing both real and fictitious brands to create credible but malicious sites that entice victims to download malware. Brands like Fortnite and Zoom have been impersonated, alongside made-up names like Vortax and NightVerse.
Target Platforms:
- Windows: The group employs #HijackLoader to deliver info-stealing malware like Stealc and Rhadamanthys, which can collect sensitive information and even redirect cryptocurrency transactions.
- macOS: The AMOS stealer is utilized, capable of retrieving data from web browsers and Apple Keychain, including WiFi credentials and saved logins.
Infection Methods: Malware is distributed through malicious websites, executable files in torrent downloads, and fake virtual applications.
To protect against such threats, users are advised to avoid links from unknown sources and only download software from official sites. Regularly scanning files with up-to-date antivirus software is also recommended to prevent infections.