New Cyberattack Campaign Utilizes MSIX Windows App Package Files to Distribute GHOSTPULSE Malware Loader

In the ever-evolving landscape of cyber threats, a new attack campaign has emerged, leveraging spurious MSIX Windows app package files. This sophisticated campaign targets popular software applications like Google Chrome, Microsoft Edge, Brave, Grammarly, and Cisco Webex to distribute a novel malware loader called GHOSTPULSE. The attackers behind this campaign employ various techniques to entice users into downloading the MSIX packages, including compromised websites, search engine optimization (SEO) poisoning, and malvertising.

Understanding MSIX

MSIX is a Windows app package format that developers can utilize to package, distribute, and install their applications for Windows users. It offers several advantages, such as streamlined updates and improved security. However, the usage of MSIX requires access to code signing certificates, which are either acquired legitimately or stolen. These certificates bestow authenticity upon the app packages but also make the attackers’ task more complex, as they need above-average resources to obtain or compromise such certificates.

Accessing MSIX files

The reliance on code signing certificates introduces an additional layer of difficulty for attackers. Acquiring or stealing these certificates requires significant resources and expertise, making them more attractive to groups with above-average capabilities. By leveraging these certificates, the attackers can potentially bypass security measures that rely on the authenticity and trustworthiness of signed app packages.

Distribution techniques

To ensure the successful dissemination of their malicious payload, the attackers employ a range of distribution techniques. Compromised websites, often through vulnerabilities or maliciously injected code, serve as platforms to host the spurious MSIX packages. Additionally, these attackers employ search engine optimization (SEO) poisoning techniques to manipulate search engine rankings and redirect unsuspecting users to their malicious pages. The use of malvertising, wherein malicious ads are spread across legitimate websites, is yet another avenue exploited by these threat actors.

Execution of GHOSTPULSE

Once a user unwittingly launches the fraudulent MSIX file, a Windows prompt appears, urging the user to click the “Install” button. Unfortunately, by doing so, the user unknowingly initiates the stealthy download of GHOSTPULSE onto their compromised host. The malware is retrieved from a remote server, specifically “manojsinghnegi[.]com,” using a PowerShell script to execute the download process.

Multiple stages of payload

The attack campaign incorporates a multi-stage payload delivery strategy to avoid detection and increase the chances of successful infiltration. The initial payload is a TAR archive file containing an executable that masquerades as the Oracle VM VirtualBox service, VBoxSVC.exe. However, under the camouflage, the executable is a legitimate binary from Notepad++ (gup.exe).

Execution of malicious DLL

Upon execution, the PowerShell script triggers the binary VBoxSVC.exe, which then proceeds to side-load the malicious DLL libcurl.dll from the current directory. By taking this approach, the threat actor minimizes the on-disk footprint of the encrypted malicious code, making it more difficult for file-based antivirus and machine learning scanning systems to detect and block the payload.

Tampered DLL and payload

The tampered DLL, libcurl.dll, processes the handoff.wav file. This file serves as the carrier for an encrypted payload that is subsequently decrypted. To execute the payload, the attackers employ a technique known as module stomping. This involves the manipulation of the mshtml.dll module to load and execute GHOSTPULSE, completing the malware’s initial deployment and activation.

Loading GHOSTPULSE

GHOSTPULSE functions as a loader, and its primary role is to facilitate the execution and deployment of an array of sophisticated malware. In this campaign, the attackers utilize a technique known as process doppelganging to kick-start the execution of the final payload. This technique involves creating a new process that mimics a legitimate process, evading detection by security systems.

Final version

Once GHOSTPULSE has successfully executed the process doppelgänging technique, it initiates the execution of various malware strains. These include SectopRAT, Rhadamanthys, Vidar, Lumma, and NetSupport RAT. Each of these malware variants possesses unique capabilities and presents further risks to the compromised host, including information theft, surveillance, and remote control.

The rise of cyberattack campaigns utilizing MSIX Windows app package files highlights the increasing need for vigilance and robust security measures. These sophisticated attacks targeting popular software applications demonstrate the ingenuity and resourcefulness of threat actors. As organizations and individuals navigate the digital landscape, it is crucial to stay informed, exercise caution when installing software or downloading files, and maintain up-to-date security measures to mitigate the risk of falling victim to such campaigns.

Explore more

Revolutionizing SaaS with Customer Experience Automation

Imagine a SaaS company struggling to keep up with a flood of customer inquiries, losing valuable clients due to delayed responses, and grappling with the challenge of personalizing interactions at scale. This scenario is all too common in today’s fast-paced digital landscape, where customer expectations for speed and tailored service are higher than ever, pushing businesses to adopt innovative solutions.

Trend Analysis: AI Personalization in Healthcare

Imagine a world where every patient interaction feels as though the healthcare system knows them personally—down to their favorite sports team or specific health needs—transforming a routine call into a moment of genuine connection that resonates deeply. This is no longer a distant dream but a reality shaped by artificial intelligence (AI) personalization in healthcare. As patient expectations soar for

Trend Analysis: Digital Banking Global Expansion

Imagine a world where accessing financial services is as simple as a tap on a smartphone, regardless of where someone lives or their economic background—digital banking is making this vision a reality at an unprecedented pace, disrupting traditional financial systems by prioritizing accessibility, efficiency, and innovation. This transformative force is reshaping how millions manage their money. In today’s tech-driven landscape,

Trend Analysis: AI-Driven Data Intelligence Solutions

In an era where data floods every corner of business operations, the ability to transform raw, chaotic information into actionable intelligence stands as a defining competitive edge for enterprises across industries. Artificial Intelligence (AI) has emerged as a revolutionary force, not merely processing data but redefining how businesses strategize, innovate, and respond to market shifts in real time. This analysis

What’s New and Timeless in B2B Marketing Strategies?

Imagine a world where every business decision hinges on a single click, yet the underlying reasons for that click have remained unchanged for decades, reflecting the enduring nature of human behavior in commerce. In B2B marketing, the landscape appears to evolve at breakneck speed with digital tools and data-driven tactics, but are these shifts as revolutionary as they seem? This