The Recycler
  • Katun web banner December 2022 NEW
  • G&G Web banner May 2024
  • Biuromax Masthead web banner March 2024

HP warns of ChromeLoader malware campaign

June 16, 2023

HP’s latest Wolf Security Threat Insights Report finds attackers hiding malware in OneNote documents, while threat actors use trusted domains to bypass Office macro controls.

HP Inc. issued its quarterly HP Wolf Security Threat Insights Report, showing threat actors are hijacking users’ Chrome browsers if they try to download popular movies or video games from pirating websites.

By isolating threats that have evaded detection tools on PCs, HP Wolf Security has specific1 insight into the latest techniques being used by cybercriminals in the fast-changing cybercrime landscape. To date, HP Wolf Security customers have clicked on over 30 billion email attachments, web pages, and downloaded files with no reported breaches.

Based on data from millions of endpoints running HP Wolf Security, the researchers found:

  • The Shampoo Chrome extension is hard to wash out: A campaign distributing the ChromeLoader malware tricks users into installing a malicious Chrome extension called Shampoo. It can redirect the victim’s search queries to malicious websites, or pages that will earn the criminal group money through ad campaigns. The malware is highly persistent, using Task Scheduler to re-launch itself every 50 minutes.
  • Attackers bypass macro policies by using trusted domains: While macros from untrusted sources are now disabled, HP saw attackers bypass these controls by compromising a trusted Office 365 account, setting up a new company email, and distributing a malicious excel file that infects victims with the Formbook infostealer.
  • Firms must beware of what lurks beneath: OneNote documents can act as digital scrapbooks, so any file can be attached within. Attackers are taking advantage of this to embed malicious files behind fake “click here” icons. Clicking the fake icon opens the hidden file, executing malware to give attackers access to the users’ machine – this access can then be sold on to other cybercriminal groups and ransomware gangs.

Sophisticated groups like Qakbot and IcedID first embedded malware into OneNote files in January. With OneNote kits now available on cybercrime marketplaces and requiring little technical skill to use, their malware campaigns look set to continue over the coming months.

“To protect against the latest threats, we advise that users and businesses avoid downloading materials from untrusted sites, particularly pirating sites. Employees should be wary of suspicious internal documents and check with the sender before opening. Organisations should also configure email gateway and security tool policies to block OneNote files from unknown external sources,” explained Patrick Schläpfer, Malware Analyst at the HP Wolf Security threat research team, HP Inc.

From malicious archive files to HTML smuggling, the report also shows cybercrime groups continue to diversify attack methods to bypass email gateways, as threat actors move away from Office formats. Key findings include:

  • Archives were the most popular malware delivery type (42%) for the fourth quarter running when examining threats stopped by HP Wolf Security in Q1.
  • There was a 37-percentage-point rise in HTML smuggling threats in Q1 versus Q4.
  • There was a 4-point rise in PDF threats in Q1 versus Q4.
  • There was a 6-point drop in Excel malware (19% to 13%) in Q1 versus Q4, as the format has become more difficult to run macros in.
  • 14% of email threats identified by HP Sure Click bypassed one or more email gateway scanner in Q1 2023.
  • The top threat vector in Q1 was email (80%) followed by browser downloads (13%).

“To protect against increasingly varied attacks, organisations must follow zero trust principles to isolate and contain risky activities such as opening email attachments, clicking on links, or browser downloads. This greatly reduces the attack surface along with the risk of a breach,” commented Dr. Ian Pratt, Global Head of Security for Personal Systems, HP Inc.

HP Wolf Security runs risky tasks like opening email attachments, downloading files and clicking links in isolated, micro-virtual machines (micro-VMs) to protect users. It also captures detailed traces of attempted infections. HP’s application isolation technology mitigates threats that might slip past other security tools and provides unique insights into novel intrusion techniques and threat actor behaviour.

Categories : Around the Industry

Tags : Chrome Browser HP Inc HP Wolf Security Report Malware Threats

  • GM Technology June 2024 web ad
  • TN Core June 2024 web ad
  • G&G Big & Bold Web banner January 2024
  • Static Control June 2022 Big & Bold Ad
  • Biuromax web banner June 2024
  • Ink Tank June 2024 web ad
  • Cartridge Web June 2024 web ad
  • Apex Web banner June 2024
  • IR Italiana Web ad January 2021
  • Mito Web banner June 2024
  • HYB Web banner Jan 2024
  • Zhono Web ad March 2024
  • Altkin Web ad March 2024
  • PCL May 2024 web banner
  • Denner Feb 2024 Web Ad
  • ITP Web ad January 2021
  • CET Web ad December 2023
  • Altkin Web ad March 2024
  • Zhono Web ad March 2024
  • ITP Web ad January 2021
  • Denner Feb 2024 Web Ad
  • CET Web ad December 2023
  • Mito Web banner June 2024
  • HYB Web banner Jan 2024
  • PCL May 2024 web banner
  • Mito Web banner June 2024
  • ITP Web ad January 2021
  • HYB Web banner Jan 2024
  • CET Web ad December 2023
  • PCL May 2024 web banner
  • Denner Feb 2024 Web Ad
  • Zhono Web ad March 2024
  • Altkin Web ad March 2024

The Recycler, Wittas House, Two Rivers, Station Lane, Witney, OX28 4BH, United Kingdom | Tel: +44 (0) 1993 899800 | Fax : +44 (0) 1993 226899
©2006-2023 The Recycler - Terms & Conditions - Privacy Policy including cookie use

Web design Dorset | Websites by Mark

The Recycler Subscribe Web ad January 2021
The Recycler Subscribe Web ad January 2021