Google Ads Being Used To Distribute Malware Downloader "BATLOADER"
The cybercriminals behind the malware downloader BATLOADER have recently been found to be using Google Ads to distribute secondary payloads, such as Vidar Stealer and Ursnif. The attackers are using malicious ads to impersonate legitimate apps and services like Adobe, OpenAPI's ChatGPT, Spotify, Tableau, and Zoom.
BATLOADER is a loader responsible for disseminating next-stage malware, including information stealers, banking malware, Cobalt Strike, and even ransomware. The malware is known for its software impersonation tactics for malware delivery, achieved by setting up fake websites that host Windows installer files that masquerade as legitimate apps to trick users into clicking rogue ads on the Google search results page.
Once launched, the MSI installer files execute Python scripts that contain the BATLOADER payload, which retrieves the next-stage malware from a remote server. This marks a slight shift from the previous attack chains observed in December 2022 when the MSI installer packages were used to run PowerShell scripts to download the stealer malware.
eSentire, a cybersecurity company that analyzed the BATLOADER samples, said that the malware continues to improve since its emergence in 2022, revealing added capabilities that allow the malware to establish entrenched access to enterprise networks. According to eSentire, BATLOADER targets popular applications for impersonation, which are commonly found in business networks, and can provide more valuable footholds for monetization via fraud or hands-on-keyboard intrusions.
The use of Google Ads by cybercriminals is a growing trend that enables attackers to distribute malware more effectively. It is essential for businesses to stay vigilant and implement appropriate security measures to protect themselves from these kinds of attacks.
