CP
cyberpings
Malware & RansomwareHIGH

Malware - Bogus Avast Website Installs Venom Stealer

MWMalwarebytes Labs
Summary by CyberPings Editorial·AI-assisted·Reviewed by Rohit Rana
Updated:
🎯

Basically, a fake Avast site pretends to scan for viruses but actually installs malware that steals your information.

Quick Summary

A fake Avast site tricks users into downloading malware. This malware, Venom Stealer, targets passwords and crypto wallets. Quick action is needed to protect sensitive information.

What Happened

A fake website mimicking Avast antivirus is deceiving users into downloading malware. This site runs a phony virus scan that falsely claims your computer is infected. Once users are panicked, they are prompted to download a file disguised as a virus cleaner, but it actually installs Venom Stealer, a malware designed for data theft. This tactic exploits the trust users place in well-known brands like Avast.

The scam begins with a convincing interface that includes a logo and certification badges. Users initiate a scan, which theatrically finds multiple threats. The result? A recommendation to download a file named Avast_system_cleaner.exe. This file is the malware payload that starts stealing sensitive information immediately upon execution.

Who's Being Targeted

Anyone who visits this fraudulent site could be at risk, especially those who are not tech-savvy. The scam preys on individuals looking for antivirus solutions, exploiting their urgency to resolve perceived threats. Once the malware is installed, it targets high-value data, including passwords, session cookies, and cryptocurrency wallet information. This makes it particularly dangerous for users who store sensitive information online.

Signs of Infection

Victims may notice unusual behavior on their computers after downloading the malware. This includes the presence of a file named v20svc.exe in the Chrome application directory. Additionally, users may experience unauthorized access to their online accounts or cryptocurrency wallets. If you suspect infection, it’s crucial to act quickly and check for this file, as it indicates a likely compromise.

How to Protect Yourself

To safeguard against this threat, always download software directly from official vendor websites. Avast’s legitimate site is avast.com. If you've interacted with a suspicious site or downloaded the file, take immediate action:

  • Run a full system scan with a reputable anti-malware tool.
  • Change passwords for critical accounts, starting with email and banking.
  • Log out of all active sessions to prevent unauthorized access.
  • For cryptocurrency users, transfer funds to a new wallet created on a secure device.

By remaining vigilant and informed, you can protect yourself from these types of malware attacks.

🔒 Pro insight: The impersonation of trusted antivirus brands highlights the ongoing effectiveness of social engineering tactics in malware distribution.

Original article from

MWMalwarebytes Labs
Read Full Article

Also covered by

SESecurityWeek

Venom Stealer Raises Stakes With Continuous Credential Harvesting

Read Article

Share

Related Pings

HIGHMalware & Ransomware

Malware Newsletter Round 91 - Latest Threats and Insights

The latest malware newsletter reveals new threats like Infiniti Stealer and npm supply chain attacks. Developers and organizations must stay alert to evolving risks in cybersecurity.

Security Affairs·
HIGHMalware & Ransomware

Malicious Email Delivers CMD Malware - Privilege Escalation Alert

A malicious email has delivered a .cmd malware file that escalates privileges and bypasses antivirus systems. Users are at risk of significant system compromise. Awareness and immediate action are vital to mitigate this threat.

Security Affairs·
HIGHMalware & Ransomware

Axios NPM Package Compromised - Supply Chain Attack Exposed

A major supply chain attack compromised the Axios NPM package, affecting millions of users. Malicious versions deployed a RAT, posing serious security risks. Swift action was taken to remove the threats.

Trend Micro Research·
HIGHMalware & Ransomware

Brokk Hacked - Play Ransomware Exposes Sensitive Data

Brokk has reportedly been hacked by Play ransomware, leading to the leak of sensitive corporate data. This incident could severely impact the company's reputation and security. Organizations must bolster their defenses to prevent similar breaches.

SC Media·
HIGHMalware & Ransomware

Chaos Malware - New Targeting of 64-bit Linux Servers

Chaos malware has evolved to target 64-bit Linux servers, expanding its attack surface. This shift raises alarms for organizations relying on these systems. Enhanced security measures are now crucial to protect against potential larger-scale attacks.

SC Media·
HIGHMalware & Ransomware

Phorpiex Botnet - Spreading Ransomware and Sextortion Tactics

The notorious Phorpiex botnet is back, spreading ransomware and sextortion schemes. Millions are at risk as it targets users globally. Stay alert and protect your devices from this evolving threat.

Cyber Security News·