A malware campaign is using fake PDF to DOCX converters as a vector for sneaking malicious PowerShell commands onto machines, enabling the attacker to access crypto wallets, hijack browser credentials and steal information.

Following an FBI alert last month, CloudSEK Security Research team has carried out an investigation revealing details about the attacks.

The goal is to trick users into executing a PowerShell command which installs the Arechclient2 malware, a variant of SectopRAT, an information stealing family known to harvest sensitive data from victims.

The malicious websites impersonate that of legitimate file converter PDFCandy, but instead of loading the real software, the malware is downloaded. The site features loading bars and even CAPTCHA verification in order to lull users into a false sense of security.

Ultimately, after several redirects, the victim’s machine downloads an "adobe.zip" file containing the payload—exposing the device to the Remote Access Trojan, which has been active since 2019.

This leaves users open to data theft, including browser credentials and cryptocurrency wallet information.

The malware “checks extension stores, lifts seed phrases, and even taps into Web3 APIs to ghost-drain assets post-approval,” Stephen Ajayi, Dapp Audit Technical Lead at blockchain security firm Hacken, told Decrypt.

CloudSEK advised people to use antivirus and antimalware software, and to "Verify file types beyond just extensions, as malicious files often masquerade as legitimate document types."

The cybersecurity firm also advises that users rely on “trusted, reputable file conversion tools from official websites rather than searching for 'free online file converters'," and to consider using “offline conversion tools that don't require uploading files to remote servers."

Hacken’s Ajayi advised crypto users to remember that, “Trust is a spectrum, it’s earned, not given. In cybersecurity, assume nothing is safe by default.” He added that they should, “Apply a zero trust mindset, and keep your security stack up to date especially EDR and AV tools that can flag behavioral anomalies like rogue msbuild.exe activity.”

“Attackers evolve constantly and so should defenders,” Ajayi noted, adding that, “Regular training, situational awareness, and strong detection coverage are essential. Stay skeptical, prepare for worst-case scenarios, and always have a tested response playbook ready to go.”

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。