A new ChromeLoader malware campaign has been observed being distributed via virtual hard disk (VHD) files, marking a deviation from the ISO optical disc image format.
“These VHD files are being distributed with filenames that make them appear like either hacks or cracks for Nintendo and Steam games.
ChromeLoader (aka Choziosi Loader or ChromeBack) originally surfaced in January 2022 as a browser-hijacking credential stealer but has since evolved into a more potent, multifaceted threat capable of stealing sensitive data, deploying ransomware, and even dropping decompression bombs.
What is ChromeLoader Malware: The primary goal of the malware is to compromise web browsers like Google Chrome, and modify the browser settings to intercept and direct traffic to dubious advertising websites. What’s more, ChromeLoader has emerged as a conduit to carry out click fraud by leveraging a browser extension to monetize clicks.
There are many variants of this new Malware and they all have basically the same objectives.
The infection chain indicates that users looking for pirated software and video game cheats are the main targets, leading to the download of VHD files from fraudulent websites appearing on search results pages.
Some of the game titles and popular software used are Elden Ring, Dark Souls III, Red Dead Redemption 2, Need for Speed, Call of Duty, The Legend of Zelda: Breath of the Wild, Mario Kart 8 Deluxe, Super Mario Odyssey, Microsoft Office, and Adobe Photoshop.
To mitigate such risks of infection, it’s recommended that users refrain from following suspicious links and download software only from official sources. “NOT PIRATED”
Source: THN