Beware of this new malware on Facebook Messenger

If the user's Facebook account is set to log in automatically, "Digmine" will manipulate Facebook Messenger in order to send a link to the file to the account's friends.

    The year 2017 has proved to be a lucrative year for cybercrime. There were prominent malware and ransomware attacks this year and it looks like the methods continue to evolve at a frightening pace. While many have been creatively bypassing existing security solutions these malware simple, yet highly effective are causing rapid destruction globally.

    Beware of this new malware on Facebook Messenger

     

    Having said that a new cryptocurrency-mining bot, named "Digmine", that was first observed in South Korea, is spreading fast through Facebook Messenger across the world, Tokyo-headquartered cybersecurity major Trend Micro has warned. After South Korea, it has since spread in Vietnam, Azerbaijan, Ukraine, the Philippines, Thailand, and Venezuela. It is likely to reach other countries soon, given the way it propagates.

    Facebook Messenger works across different platforms but "Digmine" only affects the Messenger's desktop or web browser (Chrome) version. If the file is opened on other platforms, the malware will not work as intended, Trend Micro said in a blog post. "Digmine" is coded in AutoIt and sent to would-be victims posing as a video file but is actually an AutoIt executable script.

    If the user's Facebook account is set to log in automatically, "Digmine" will manipulate Facebook Messenger in order to send a link to the file to the account's friends. The abuse of Facebook is limited to propagation for now, but it wouldn't be implausible for attackers to hijack the Facebook account itself down the line. This functionality's code is pushed from the command-and-control (C&C) server, which means it can be updated.

    A known modus operandi of cryptocurrency-mining botnets and particularly for "Digmine" (which mines Monero), is to stay in the victim's system for as long as possible. It also wants to infect as many machines as possible, as this translates to an increased hash rate and potentially more cybercriminal income, the blog post stated. The malware will also perform other routines such as installing a registry autostart mechanism as well as system infection marker. It will search and launch Chrome then load a malicious browser extension that it retrieves from the C&C server.

     

    If Chrome is already running, the malware will terminate and relaunch Chrome to ensure the extension is loaded. While extensions can only be loaded and hosted from the Chrome Web Store, the attackers bypassed this by launching Chrome via command line.

    Inputs from IANS

    Opinion Poll
    X

    Stay updated with latest technology news & gadget reviews - Gizbot

    Notification Settings X
    Time Settings
    Done
    Clear Notification X
    Do you want to clear all the notifications from your inbox?
    Yes No
    Settings X
    We use cookies to ensure that we give you the best experience on our website. This includes cookies from third party social media websites and ad networks. Such third party cookies may track your use on Gizbot sites for better rendering. Our partners use cookies to ensure we show you advertising that is relevant to you. If you continue without changing your settings, we'll assume that you are happy to receive all cookies on Gizbot website. However, you can change your cookie settings at any time. Learn more