SEO Poisoning Campaign Targets 8500+ SMB Users with Malware Disguised as AI Tools
A malicious campaign that uses search engine optimization (SEO) poisoning techniques to distribute Oyster, a known malware loader (also known as Broomstick or CleanUpLoader), has been revealed by cybersecurity experts.
According to Arctic Wolf, the malvertising activity encourages phony websites that offer trojanized copies of genuine tools like PuTTY and WinSCP in an attempt to fool software professionals who are looking for these products into installing them instead.
A backdoor called Oyster/Broomstick is deployed upon execution, the business stated in a brief released last week.
By using the DllRegisterServer export to create a scheduled job that executes a malicious DLL (twain_96.dll) via rundll32.exe every three minutes, persistence is established, demonstrating the use of ...