Beware: Tainted VPNs Being Used to Spread EyeSpy Surveillanceware

Jan 13, 2023Ravie LakshmananVPN / Surveillanceware

Tainted VPN installers are being used to deliver a piece of
surveillanceware dubbed EyeSpy as part of a
malware campaign that started in May 2022.

It uses “components of SecondEye – a legitimate monitoring
application – to spy on users of 20Speed VPN, an Iranian-based VPN
service, via trojanized installers,” Bitdefender said^[1]
in an analysis.

A majority of the infections are said to originate in Iran, with
smaller detections in Germany and the U.S., the Romanian
cybersecurity firm added.

SecondEye, according to snapshots^[2]
captured via the Internet Archive, claims to be a commercial
monitoring software that can work as a “parental control system or
as an online watchdog.” As of November 2021, it’s offered for sale
anywhere between $99 to $200.

It comes with a wide range of features that allows it to take
screenshots, record microphone, log keystrokes, gather files and
saved passwords from web browsers, and remotely control the
machines to run arbitrary commands.

SecondEye previously came under the radar in August 2022, when
Blackpoint Cyber revealed^[3]
the threat actors’ use of its spyware modules and infrastructure
for data and payload storage.

The latest attack chain begins when an unsuspecting user
downloads a malicious executable from 20Speed VPN’s website,
indicating two plausible scenarios: Either that the its servers
were breached to host the spyware or it’s a deliberate attempt to
spy on individuals who might download VPN apps to bypass^[4]
internet blackouts^[5]
in the country.

Once installed, the legitimate VPN service is launched, while
also stealthily kicking off a train of nefarious activities in the
background so as to establish persistence and download next-stage
payloads for harvesting personal data from the host.

“EyeSpy has the ability to fully compromise online privacy via
keylogging and stealing of sensitive information, such as
documents, images, crypto wallets, and passwords,” Bitdefender
researcher Janos Gergo Szeles said. “This can lead to complete
account takeovers, identity theft and financial loss.”