Fake IT Support: Your Browser Crash is Their Entry

Cybercriminals have shifted tactics, moving away from direct software exploitation to manipulating user behavior. A recent campaign detailed by Huntress involves attackers causing browser crashes, followed by alarming security messages that prompt users to seek a "repair." This creates urgency, leading to direct communication with the employee.

Attackers pose as internal IT support, gaining credibility and persuading victims to cooperate. The process begins with spam flooding inboxes, immediately followed by a "support" call. Victims are convinced to perform actions that facilitate the compromise, such as approving remote access or installing tools like AnyDesk.

Users are often instructed to execute scripts disguised as fixes. During remote sessions, they are directed to fake Microsoft-themed sites to download disguised archive files. Once executed, these files contain components to deploy the Havoc C2 framework, utilizing DLL sideloading to run malicious code undetected.

This human-centric approach bypasses firewalls and traditional defenses. The rapid spread, with one instance reaching nine endpoints in eleven hours, indicates operator control. The tactic underscores the increasing reliance on social engineering over technical vulnerabilities.