Chrome’s big design refresh uses Microsoft Mica effect in custom themes

New Hacker Group ‘GambleForce’ Tageting APAC Firms Using SQL Injection Attacks

A previously unknown hacker outfit called GambleForce has been attributed to a series of SQL injection attacks against companies primarily in the Asia-Pacific (APAC) region since at least September 2023.
"GambleForce uses a set of basic yet very effective techniques, including SQL injections and the exploitation of vulnerable website content management systems (CMS) to steal sensitive   Read More 

The Hacker News | #1 Trusted Cybersecurity News Site 

Hackers Weaponized Electron Framework to Steal Data Stealthy

[[{“value”:”

Hackers abuse Electron Framework’s cross-platform desktop app capabilities, which are based on web technologies like HTML, JS, and CSS. 

The flexibility and widespread adoption of the Electron Framework enables the creation of several malicious programs cross-OS. 

Cybersecurity researchers at ASEC recently discovered that hackers have been actively using the Electron Framework to build advanced infostealer malware, which harvests sensitive data from infected systems.

Technical Analysis

Electron apps use Nullsoft Scriptable Install System (NSIS) installers, and the hackers packaged their malware in an NSIS installer, exploiting the Electron’s capabilities.

Free Webinar | Mastering WAAP/WAF ROI Analysis | Book Your Spot

The threat actor applied this installation format to the malware in this attack event.

Researchers identified that there are two cases:-

Case 1

Running the malware installs and executes an Electron app with a folder structure.

Electron leverages Node.js for OS interaction, so malicious behaviors exist in the Node script inside the .asar file (typically appresources path).

Unpacking via npm asar exposes the full code, with malicious logic defined in a.js.

Case 2

Another strain poses as TeamViewer, exfiltrating user data (system info, browser histories, credentials) to gofile file-sharing service. 

While NSI scripts often directly run malware from NSIS installers, these strains leverage Electron’s structure for obfuscation, evading detection by users and security tools. 

Besides this, to stay safe, security analysts urged users to obtain games and utilities only from the official websites.

Recommendations

Here below we have mentioned all the recommendations:-

To avoid downloading malware that is disguised as genuine software, only get such programs from official sources.

Make sure you are careful with any Electron framework-based application since they may be hiding malicious code.

Be sure to update your security software and operating system frequently to block new kinds of threats.

You must be suspicious about installation files in the NSIS format because they can execute malicious codes.

Enforce access controls and monitor uploads for potential data leaks.

Users should know about the danger of downloading malware which looks like real applications. 

It is important to verify the authenticity of software and its source.

IoCs

9926e2782d603061b52d88f83d93e7af (TeamViewer.exe)

cfc6e0014b3cc8d4dcaf0d76e2382556 (BetterShaders Setup 1.0.3.exe)

b150afa6b3642ea1da1233b76f7b454e (Software.exe)

Looking to Safeguard Your Company from Advanced Cyber Threats? Deploy TrustNet to Your Radar ASAP.

The post Hackers Weaponized Electron Framework to Steal Data Stealthy appeared first on Cyber Security News.

“}]]   Read More 

Cyber Security News