New NullMixer Malware Campaign Stealing Users’ Payment Data and Credentials

Cybercriminals are continuing to prey on users searching for
cracked software by directing them to fraudulent websites hosting
weaponized installers that deploy malware called
NullMixer on compromised systems.

“When a user extracts and executes NullMixer, it drops a number
of malware files to the compromised machine,” cybersecurity firm
Kaspersky said in a Monday report. “It drops a wide variety of
malicious binaries to infect the machine with, such as backdoors,
bankers, downloaders, spyware, and many others.”

Besides siphoning users’ credentials, address, credit card data,
cryptocurrencies, and even Facebook and Amazon account session
cookies, what makes NullMixer insidious is its ability to download
dozens of trojans at once, significantly widening the scale of the
infections.

Attack chains typically start when a user attempts to download
cracked software from one of the sites, which leads to a
password-protected archive that contains an executable file that,
for its part, drops and launches a second setup binary designed to
deliver an array of malicious files.

These malicious websites leverage search engine optimization
(SEO) poisoning techniques such as keyword stuffing to feature them
highly in search engine results. Similar tactics have been adopted^[1]
by actors behind GootLoader^[2]
and SolarMarker^[3]
campaigns.

NullMixer, last month, was linked to the distribution of a rogue
Google Chrome extension called FB Stealer^[4], which is capable of
Facebook credential theft and search engine substitution.

Some of the other prominent malware families distributed by the
dropper include DanaBot and a raft of information-stealing malware
such as ColdStealer^[5], PseudoManuscrypt^[6], Raccoon Stealer^[7], Redline Stealer^[8], and Vidar^[9].

Also deployed using NullMixer are trojan downloaders like
FormatLoader, GCleaner, LegionLoader (aka Satacom), LgoogLoader,
PrivateLoader^[10], SgnitLoader,
ShortLoader, and SmokeLoader^[11], as well as the C-Joker
cryptocurrency wallet stealer.

Kaspersky said it blocked attempts to infect more than 47,778
victims worldwide, with a majority of the users located in Brazil,
India, Russia, Italy, Germany, France, Egypt, Turkey, and the U.S.
The threat actor operating NullMixer has not been attributed to a
known group.

The latest findings are yet another indication that malware and
unwanted applications are being increasingly propagated via pirated
software. It’s also recommended to check online accounts regularly
for unknown transactions.

“Any download of files from untrustworthy resources is a real
game of roulette: you never know when it will fire, and which
threat you will get this time,” Kaspersky researcher Haim Zigel
said^[12]. “Receiving NullMixer,
users get several threats at once.”