As if there weren’t enough threats to your Windows computer already, here is another one to be careful with. Kaspersky reports that tens of thousands of compromised PCs are infected as cybercriminals advertise fake activators and cracks to lure in unsuspecting users for distinct software such as AutoCAD, JetBrains, and Foxit PDF Editor.
The malicious package named SteelFox has been quietly spreading since February 2023, but its distribution has exploded recently. The malware is dispersed using torrent trackers and forums, where it is used as a tool to activate authentic versions of the previously mentioned software.
The experts at Kaspersky warn that the malware mimics cryptocurrencies and steals sensitive financial and non-financial information from your devices. When you install the fake crack, a vulnerable driver called WinRingO.sys is added that restores CVE-2021-41285 and CVE-2020-14979, four- and three-year-old vulnerabilities that give hackers full access to your PC.
When hackers access these vulnerabilities, they insert XMRig, a program that steals computer resources to mine cryptocurrency, an attack known as cryptojacking. XMRig uses your electricity, PC power, and the internet to mine Monero and other cryptocurrencies, making your PC useless. An info stealer is also inserted to retrieve data from 13 web browsers, including browsing history, credit card info, session cookies, network data, and system information. A Remote Desktop Protocol (RDP) connection is also established.
The report also mentioned a malicious post that included complete instructions on how to launch the software illegally. Further, Kaspersky says that “the execution chain looks legitimate until the moment the files are unpacked.” The damaging software is inserted in the process and adds the machine code that launches Steelfox.
Kaspersky also says it has blocked 11,000 attacks thus far, but the number can easily be much higher. Affected users are worldwide, including in countries such as Mexico, Brazil, Russia, China, UAE, Algeria, Egypt, Vietnam, Sri Lanka, and India.
You can stay safe by only downloading software from legitimate sources, and having top-tier antivirus software such as Bitdefender is a great idea.
Related Posts
Qualcomm is set to ratchet up chip prices in September, and your next gadget upgrade could bear the brunt
The price hike will be in effect from September 1, 2026, a recent Bloomberg report claims. Essentially, all the companies placing their chip orders after that will pay a higher price.
Stop fighting with your roomie over outlets and get one of these multi-port chargers before you head back to school
Back-to-school season is a smart time to buy one. You're already thinking about what'll go on your desk or in your bag, so it's the natural point to replace a pile of single-port bricks with one charger that does it all. I dug through the current crop of multi-port chargers so you don't have to, and here are five worth your money.
OpenAI’s rogue AI hack was just the beginning, Hugging Face warns
Speaking to the BBC, Wolf warned that AI-driven intrusions could become one of the most common forms of cyberattack and said many companies have yet to realize how dramatically the threat has changed. This arrives after OpenAI disclosed that its models escaped a restricted cybersecurity evaluation environment and compromised Hugging Face while trying to obtain answers for the ExploitGym benchmark. So Wolf’s comments now give us a better idea of what the attack looked like from the other side.