New Cyberattack Campaign Utilizes MSIX Windows App Package Files to Distribute GHOSTPULSE Malware Loader

In the ever-evolving landscape of cyber threats, a new attack campaign has emerged, leveraging spurious MSIX Windows app package files. This sophisticated campaign targets popular software applications like Google Chrome, Microsoft Edge, Brave, Grammarly, and Cisco Webex to distribute a novel malware loader called GHOSTPULSE. The attackers behind this campaign employ various techniques to entice users into downloading the MSIX packages, including compromised websites, search engine optimization (SEO) poisoning, and malvertising.

Understanding MSIX

MSIX is a Windows app package format that developers can utilize to package, distribute, and install their applications for Windows users. It offers several advantages, such as streamlined updates and improved security. However, the usage of MSIX requires access to code signing certificates, which are either acquired legitimately or stolen. These certificates bestow authenticity upon the app packages but also make the attackers’ task more complex, as they need above-average resources to obtain or compromise such certificates.

Accessing MSIX files

The reliance on code signing certificates introduces an additional layer of difficulty for attackers. Acquiring or stealing these certificates requires significant resources and expertise, making them more attractive to groups with above-average capabilities. By leveraging these certificates, the attackers can potentially bypass security measures that rely on the authenticity and trustworthiness of signed app packages.

Distribution techniques

To ensure the successful dissemination of their malicious payload, the attackers employ a range of distribution techniques. Compromised websites, often through vulnerabilities or maliciously injected code, serve as platforms to host the spurious MSIX packages. Additionally, these attackers employ search engine optimization (SEO) poisoning techniques to manipulate search engine rankings and redirect unsuspecting users to their malicious pages. The use of malvertising, wherein malicious ads are spread across legitimate websites, is yet another avenue exploited by these threat actors.

Execution of GHOSTPULSE

Once a user unwittingly launches the fraudulent MSIX file, a Windows prompt appears, urging the user to click the “Install” button. Unfortunately, by doing so, the user unknowingly initiates the stealthy download of GHOSTPULSE onto their compromised host. The malware is retrieved from a remote server, specifically “manojsinghnegi[.]com,” using a PowerShell script to execute the download process.

Multiple stages of payload

The attack campaign incorporates a multi-stage payload delivery strategy to avoid detection and increase the chances of successful infiltration. The initial payload is a TAR archive file containing an executable that masquerades as the Oracle VM VirtualBox service, VBoxSVC.exe. However, under the camouflage, the executable is a legitimate binary from Notepad++ (gup.exe).

Execution of malicious DLL

Upon execution, the PowerShell script triggers the binary VBoxSVC.exe, which then proceeds to side-load the malicious DLL libcurl.dll from the current directory. By taking this approach, the threat actor minimizes the on-disk footprint of the encrypted malicious code, making it more difficult for file-based antivirus and machine learning scanning systems to detect and block the payload.

Tampered DLL and payload

The tampered DLL, libcurl.dll, processes the handoff.wav file. This file serves as the carrier for an encrypted payload that is subsequently decrypted. To execute the payload, the attackers employ a technique known as module stomping. This involves the manipulation of the mshtml.dll module to load and execute GHOSTPULSE, completing the malware’s initial deployment and activation.

Loading GHOSTPULSE

GHOSTPULSE functions as a loader, and its primary role is to facilitate the execution and deployment of an array of sophisticated malware. In this campaign, the attackers utilize a technique known as process doppelganging to kick-start the execution of the final payload. This technique involves creating a new process that mimics a legitimate process, evading detection by security systems.

Final version

Once GHOSTPULSE has successfully executed the process doppelgänging technique, it initiates the execution of various malware strains. These include SectopRAT, Rhadamanthys, Vidar, Lumma, and NetSupport RAT. Each of these malware variants possesses unique capabilities and presents further risks to the compromised host, including information theft, surveillance, and remote control.

The rise of cyberattack campaigns utilizing MSIX Windows app package files highlights the increasing need for vigilance and robust security measures. These sophisticated attacks targeting popular software applications demonstrate the ingenuity and resourcefulness of threat actors. As organizations and individuals navigate the digital landscape, it is crucial to stay informed, exercise caution when installing software or downloading files, and maintain up-to-date security measures to mitigate the risk of falling victim to such campaigns.

Explore more

Can Stablecoins Balance Privacy and Crime Prevention?

The emergence of stablecoins in the cryptocurrency landscape has introduced a crucial dilemma between safeguarding user privacy and mitigating financial crime. Recent incidents involving Tether’s ability to freeze funds linked to illicit activities underscore the tension between these objectives. Amid these complexities, stablecoins continue to attract attention as both reliable transactional instruments and potential tools for crime prevention, prompting a

AI-Driven Payment Routing – Review

In a world where every business transaction relies heavily on speed and accuracy, AI-driven payment routing emerges as a groundbreaking solution. Designed to amplify global payment authorization rates, this technology optimizes transaction conversions and minimizes costs, catalyzing new dynamics in digital finance. By harnessing the prowess of artificial intelligence, the model leverages advanced analytics to choose the best acquirer paths,

How Are AI Agents Revolutionizing SME Finance Solutions?

Can AI agents reshape the financial landscape for small and medium-sized enterprises (SMEs) in such a short time that it seems almost overnight? Recent advancements suggest this is not just a possibility but a burgeoning reality. According to the latest reports, AI adoption in financial services has increased by 60% in recent years, highlighting a rapid transformation. Imagine an SME

Trend Analysis: Artificial Emotional Intelligence in CX

In the rapidly evolving landscape of customer engagement, one of the most groundbreaking innovations is artificial emotional intelligence (AEI), a subset of artificial intelligence (AI) designed to perceive and engage with human emotions. As businesses strive to deliver highly personalized and emotionally resonant experiences, the adoption of AEI transforms the customer service landscape, offering new opportunities for connection and differentiation.

Will Telemetry Data Boost Windows 11 Performance?

The Telemetry Question: Could It Be the Answer to PC Performance Woes? If your Windows 11 has left you questioning its performance, you’re not alone. Many users are somewhat disappointed by computers not performing as expected, leading to frustrations that linger even after upgrading from Windows 10. One proposed solution is Microsoft’s initiative to leverage telemetry data, an approach that