Home / Technology / Fake photo tool hijacks selfies for malware
Fake photo tool hijacks selfies for malware
7 May
Summary
- A fake photo tool leads to malware infection through SEO poisoning.
- Victims run malware themselves via ClickFix tactics.
- Malware steals credentials, crypto, and grants remote access.
Cybersecurity researchers have uncovered a malicious website that poses as a photo background removal tool but instead deploys infostealing malware. This site achieved top search engine rankings through SEO poisoning, ensnaring users searching for legitimate photo editing services.
Upon uploading a photo, the site prompts users to verify their humanity by executing a command through the Windows Run program. This action, a tactic known as ClickFix, installs CastleLoader malware. Subsequently, this loader deploys NetSupport RAT, a remote access trojan, and CastleStealer, a custom .NET stealer designed to exfiltrate browser credentials, cryptocurrency wallet data, and Discord or Telegram tokens.
The campaign highlights the significant risks associated with SEO poisoning and social engineering, where seemingly simple online tasks can result in severe credential theft and remote system compromise. Mitigation strategies include educating users to be wary of requests to run on-device commands for verification and disabling the Win+R shortcut to prevent accidental execution of malicious code.
