A malware campaign has compromised over 800 WordPress websites to deliver a banking trojan named Chaes that targeted Brazilian customers of Banco do Brasil, Loja Integrada, Mercado Bitcoin, Mercado Livre, and Mercado Pago.
The info stealing malware which was first reported by Cybereason in November 2020 is delivered via a sophisticated infection chain which is engineered to collect sensitive consumer information, including login credentials, credit card numbers, and other financial information.
According to Avast researchers Anh Ho and Igor Morgenstern, Chaes is characterized by the multiple-stage delivery that utilizes scripting frameworks such as JScript, Python, and NodeJS, binaries written in Delphi, and malicious Google Chrome extensions.
The main aim of Chaes is to steal credentials stored in Chrome and intercept logins of popular banking websites in Brazil.”
When users visit one of the infected websites, a pop-up is displayed that tempts them to install a fake Java Runtime application. The rogue installer then initiates a complex malware delivery routine that result in the deployment of several modules.
Some of the intermediary payloads are not only encrypted but also hidden as commented-out code inside the HTML page of a Blogger blogspot domain (“awsvirtual[.]blogspot.com”).
In the final stage, a JavaScript dropper downloads and installs as many as five Chrome extensions —
- Online – A Delphi module used to fingerprint the victim and transmit the system information to a command-and-control (C2) server
- Mtps4 (MultiTela Pascal) – A Delphi-based backdoor whose main purpose is to connect to the C2 server and wait for a responding Pascal Script to execute
- Chrolog (ChromeLog) – A Google Chrome password stealer written in Delphi
- Chronodx (Chrome Noder) – A JavaScript trojan that, upon detecting the launch of Chrome browser by the victim, closes it immediately and reopens its own instance of Chrome containing a malicious module that steals banking information
- Chremows (Chrome WebSocket) – A JavaScript banking trojan that records keypresses and mouse clicks on Chrome with the goal of plundering login credentials from users of Mercado Livre and Mercado Pago
The attack process is ongoing and Avast had shared its findings with the Brazilian CERT to disrupt the malware’s spread. However, Chaes-related artifacts continue to remain on some of the infected websites.
The researchers concluded that Chaes exploits many websites containing CMS WordPress to serve malicious installers. The Google Chrome extensions are able to steal users’ credentials stored in Chrome and collect users’ banking information from popular banking websites.
Comments