New Cyberattack Campaign Utilizes MSIX Windows App Package Files to Distribute GHOSTPULSE Malware Loader

In the ever-evolving landscape of cyber threats, a new attack campaign has emerged, leveraging spurious MSIX Windows app package files. This sophisticated campaign targets popular software applications like Google Chrome, Microsoft Edge, Brave, Grammarly, and Cisco Webex to distribute a novel malware loader called GHOSTPULSE. The attackers behind this campaign employ various techniques to entice users into downloading the MSIX packages, including compromised websites, search engine optimization (SEO) poisoning, and malvertising.

Understanding MSIX

MSIX is a Windows app package format that developers can utilize to package, distribute, and install their applications for Windows users. It offers several advantages, such as streamlined updates and improved security. However, the usage of MSIX requires access to code signing certificates, which are either acquired legitimately or stolen. These certificates bestow authenticity upon the app packages but also make the attackers’ task more complex, as they need above-average resources to obtain or compromise such certificates.

Accessing MSIX files

The reliance on code signing certificates introduces an additional layer of difficulty for attackers. Acquiring or stealing these certificates requires significant resources and expertise, making them more attractive to groups with above-average capabilities. By leveraging these certificates, the attackers can potentially bypass security measures that rely on the authenticity and trustworthiness of signed app packages.

Distribution techniques

To ensure the successful dissemination of their malicious payload, the attackers employ a range of distribution techniques. Compromised websites, often through vulnerabilities or maliciously injected code, serve as platforms to host the spurious MSIX packages. Additionally, these attackers employ search engine optimization (SEO) poisoning techniques to manipulate search engine rankings and redirect unsuspecting users to their malicious pages. The use of malvertising, wherein malicious ads are spread across legitimate websites, is yet another avenue exploited by these threat actors.

Execution of GHOSTPULSE

Once a user unwittingly launches the fraudulent MSIX file, a Windows prompt appears, urging the user to click the “Install” button. Unfortunately, by doing so, the user unknowingly initiates the stealthy download of GHOSTPULSE onto their compromised host. The malware is retrieved from a remote server, specifically “manojsinghnegi[.]com,” using a PowerShell script to execute the download process.

Multiple stages of payload

The attack campaign incorporates a multi-stage payload delivery strategy to avoid detection and increase the chances of successful infiltration. The initial payload is a TAR archive file containing an executable that masquerades as the Oracle VM VirtualBox service, VBoxSVC.exe. However, under the camouflage, the executable is a legitimate binary from Notepad++ (gup.exe).

Execution of malicious DLL

Upon execution, the PowerShell script triggers the binary VBoxSVC.exe, which then proceeds to side-load the malicious DLL libcurl.dll from the current directory. By taking this approach, the threat actor minimizes the on-disk footprint of the encrypted malicious code, making it more difficult for file-based antivirus and machine learning scanning systems to detect and block the payload.

Tampered DLL and payload

The tampered DLL, libcurl.dll, processes the handoff.wav file. This file serves as the carrier for an encrypted payload that is subsequently decrypted. To execute the payload, the attackers employ a technique known as module stomping. This involves the manipulation of the mshtml.dll module to load and execute GHOSTPULSE, completing the malware’s initial deployment and activation.

Loading GHOSTPULSE

GHOSTPULSE functions as a loader, and its primary role is to facilitate the execution and deployment of an array of sophisticated malware. In this campaign, the attackers utilize a technique known as process doppelganging to kick-start the execution of the final payload. This technique involves creating a new process that mimics a legitimate process, evading detection by security systems.

Final version

Once GHOSTPULSE has successfully executed the process doppelgänging technique, it initiates the execution of various malware strains. These include SectopRAT, Rhadamanthys, Vidar, Lumma, and NetSupport RAT. Each of these malware variants possesses unique capabilities and presents further risks to the compromised host, including information theft, surveillance, and remote control.

The rise of cyberattack campaigns utilizing MSIX Windows app package files highlights the increasing need for vigilance and robust security measures. These sophisticated attacks targeting popular software applications demonstrate the ingenuity and resourcefulness of threat actors. As organizations and individuals navigate the digital landscape, it is crucial to stay informed, exercise caution when installing software or downloading files, and maintain up-to-date security measures to mitigate the risk of falling victim to such campaigns.

Explore more

How Is Email Marketing Evolving with AI and Privacy Trends?

In today’s fast-paced digital landscape, email marketing remains a cornerstone of business communication, yet its evolution is accelerating at an unprecedented rate to meet the demands of savvy consumers and cutting-edge technology. As a channel that has long been a reliable means of reaching audiences, email marketing is undergoing a profound transformation, driven by advancements in artificial intelligence, shifting privacy

Why Choose FolderFort for Affordable Cloud Storage?

In an era where digital data is expanding at an unprecedented rate, finding a reliable and cost-effective cloud storage solution has become a pressing challenge for individuals and businesses alike, especially with countless files, photos, and projects piling up. The frustration of juggling multiple platforms or facing escalating subscription fees can be overwhelming. Many users find themselves trapped in a

How Can Digital Payments Unlock Billions for UK Consumers?

In an era where financial struggles remain a stark reality for millions across the UK, the promise of digital payment solutions offers a transformative pathway to economic empowerment, with recent research highlighting how innovations in this space could unlock billions in savings for consumers. These advancements also address the persistent challenge of financial exclusion. With millions lacking access to basic

Trend Analysis: Digital Payments in Township Economies

In South African townships, a quiet revolution is unfolding as digital payments reshape the economic landscape, with over 60% of spaza shop owners adopting digital transaction tools in recent years. This dramatic shift from the cash-only norm that once defined local commerce signifies more than just a change in payment methods; it represents a critical step toward financial inclusion and

Modern CRM Platforms – Review

Setting the Stage for CRM Evolution In today’s fast-paced business environment, sales teams are under immense pressure to close deals faster, with a staggering 65% of sales reps reporting that administrative tasks consume over half their workday, according to industry surveys. This challenge of balancing productivity with growing customer expectations has pushed companies to seek advanced solutions that streamline processes