Malsmoke Campaign Exploits Porn Websites to Deliver Zloader Banking Trojan

Researchers at cybersecurity company Malwarebytes warn of a new malware campaign that spreads Zloader banking trojan. The operation, which is called Malsmoke, is reported to display pop-ups on high-traffic adult websites.

According to the research, the earliest traces of the Malsmoke campaign date from August 2020. It appears that the threat actors tried to spread Smoke Loader malware dropper via exploit kits. However, in October, they changed tactics, switching to fake Java update pop-ups on adult websites that deliver the nasty credential-stealing Zloader.

The used websites are high-traffic platforms with millions of monthly visitors. Researchers warn that only the adult website xhamster, with its 975 million monthly visitors, unquestionably maximizes the chances of delivering the malware payload successfully.

Researchers also point out that there is a spike in malvertising activity in the second half of 2020, with Malsmoke being only one of many massive malware campaigns.

How does Malsmoke Infect Victims

Malsmoke uses decoy pages designed to lure visitors into clicking on images, which masquerade as videos.

If a user attempts to play the nonexistent video, a pixelated MPEG-4 clip will play for a few seconds until a message tells the user that a “Java Plug-in 8.0 was not found.”

The displayed alert will attempt to persuade the user to download a fake Java update – named JavaPlug-in.msi – that delivers a Zloader installer. Interestingly, the malicious payload is digitally signed by Microsoft and contains a number of libraries and executables, many of which are legitimate.

This final installer is designed to inject Zloader into a new msiexec.exe process that establishes a communication channel with a command and control (C2) server by using a Domain Generation Algorithm (DGA).

Upon connecting to a responding C2, the malware will start downloading additional modules, resulting in full-fledged cyber infection.