.NET developers are being targeted with malware designed to steal their cryptocurrency, new reports have claimed.
Cybersecurity researchers from JFrog recently spotted an active campaign in which malicious packages were uploaded to the NuGet repository, for .NET developers to download and use.
When activated, the packages download and run a PowerShell dropper called init.ps1, which changes the endpoint’s settings to allow PowerShell scripts to be executed without restrictions.
Custom payloads
That feature alone was enough of a red flag to warrant the package’s elimination, the researchers suggest: “This behavior is extremely rare outside of malicious packages, especially taking into consideration the “Unrestricted” execution policy, which should immediately trigger a red flag.”
Still, if allowed to operate unabated, the package will download and execute a “completely custom executable payload” for the Windows environment, the researchers added. This, too, is rare behavior, the analysts said, as hackers would usually just use open-source tools to cut down on time.
To build up their legitimacy, the hackers did two things. First, they typosquatted their NuGet repository profiles, to impersonate (opens in new tab) Microsoft software developers working on the NuGet .NET package manager.
Second, they inflated the download numbers of the malicious packages to obscene highs, to make it as if the packages were legitimate and downloaded hundreds of thousands of times. While this may still be the case, the researchers said, it is more likely that they used bots to artificially inflate the numbers to catch developers off guard.
“The top three packages were downloaded an incredible amount of times – this could be an indicator that the attack was highly successful, infecting a large amount of machines,” the JFrog security researchers said. “However, this is not a fully reliable indicator of the attack’s success since the attackers could have automatically inflated the download count (with bots) to make the packages seem more legitimate.”
Via: BleepingComputer (opens in new tab)
