The Russia-linked menace actor often called COLDRIVER has been noticed distributing a brand new malware referred to as LOSTKEYS as a part of an espionage-focused marketing campaign utilizing ClickFix-like social engineering lures.
“LOSTKEYS is able to stealing information from a hard-coded record of extensions and directories, together with sending system data and operating processes to the attacker,” the Google Risk Intelligence Group (GTIG) stated.
The malware, the corporate stated, was noticed in January, March, and April 2025 in assaults on present and former advisors to Western governments and militaries, in addition to journalists, assume tanks, and NGOs. As well as, people linked to Ukraine have additionally been singled out.
LOSTKEYS is the second customized malware attributed to COLDRIVER after SPICA, marking a continued departure from the credential phishing campaigns the menace actor has been recognized for. The hacking group can also be tracked below the names Callisto, Star Blizzard, and UNC4057.
“They’re recognized for stealing credentials and after getting access to a goal’s account they exfiltrate emails and steal contact lists from the compromised account,” safety researcher Wesley Shields stated. “In choose instances, COLDRIVER additionally delivers malware to focus on gadgets and will try to entry information on the system.”
The most recent set of assaults commences with a decoy web site containing a faux CAPTCHA verification immediate, the place victims are instructed to open the Home windows Run dialog and paste a PowerShell command copied to the clipboard, a broadly standard social engineering approach dubbed ClickFix.
The PowerShell command is designed to obtain and execute the following payload from a distant server (“165.227.148[.]68”), which acts as a downloader for a third-stage however not earlier than performing checks in a possible effort to evade execution in digital machines.
A Base64-encoded blob, the third-stage payload is decoded right into a PowerShell script that is liable for executing LOSTKEYS on the compromised host, permitting the menace actor to reap system data, operating processes, and information from a hard-coded record of extensions and directories.
Like within the case of SPICA, it has been assessed that the malware is just deployed selectively, indicative of the highly-targeted nature of those assaults.
Google additionally stated it uncovered extra LOSTKEYS artifacts going again to December 2023 that masqueraded as binaries associated to the Maltego open-source investigation platform. It is not recognized if these samples have any ties to COLDRIVER, or if the malware was repurposed by the menace actors beginning January 2025.
ClickFix Adoption Continues to Develop
The event comes as ClickFix continues to be steadily adopted by a number of menace actors to distribute a variety of malware households, together with a banking trojan referred to as Lampion and Atomic Stealer.
Assaults propagating Lampion, per Palo Alto Networks Unit 42, use phishing emails bearing ZIP file attachments as lures. Current inside the ZIP archive is an HTML file that redirects the message recipient to a faux touchdown web page with ClickFix directions to launch the multi-stage an infection course of.
“One other attention-grabbing side of Lampion’s an infection chain is that it’s divided into a number of non-consecutive phases, executed as separate processes,” Unit 42 stated. “This dispersed execution complicates detection, because the assault move doesn’t type a readily identifiable course of tree. As a substitute, it contains a posh chain of particular person occasions, a few of which may seem benign in isolation.”
The malicious marketing campaign focused Portuguese-speaking people and organizations in varied sectors, together with authorities, finance, and transportation, the corporate added.
In latest months, the ClickFix technique has additionally been mixed with one other sneaky tactic referred to as EtherHiding, which includes utilizing Binance’s Good Chain (BSC) contracts to hide the next-stage payload, in the end resulting in the supply of a macOS data stealer referred to as Atomic Stealer.
“Clicking ‘I am not a robotic’ triggers a Binance Good Contract, utilizing an EtherHiding approach, to ship a Base64-encoded command to the clipboard, which customers are prompted to run in Terminal through macOS-specific shortcuts (⌘ + Area, ⌘ + V),” an impartial researcher who goes by the alias Badbyte stated. “This command downloads a script that retrieves and executes a signed Mach-O binary, confirmed as Atomic Stealer.”
Additional investigation has discovered that the marketing campaign has probably compromised about 2,800 reputable web sites to serve faux CAPTCHA prompts. The massive-scale watering gap assault has been codenamed MacReaper by the researcher.
“The assault leverages obfuscated JavaScript, three full-screen iframes, and blockchain-based command infrastructure to maximise infections,” the researcher added.
