Proofpoint has identified a new cybersecurity threat affecting Google Chrome and Microsoft users, involving a deceptive pop-up that prompts users to execute malicious PowerShell scripts. This technique leverages social engineering tactics to trick users into copying and pasting the harmful code, leading to potential financial theft. The malware is typically distributed through malspam or web browser injections, with fake error messages prompting users to take action in PowerShell or the Windows Run dialog box.
This fraudulent campaign has been observed by security experts since March 2024, targeting users through email lures and fake HTML files resembling Microsoft Word documents. Despite the seemingly obvious signs of a scam, the social engineering tactics used in the fake error messages are sophisticated enough to convince users to follow the malicious instructions without considering the risks involved. The goal of the malware appears to be credential theft and fraudulent cryptocurrency transactions, highlighting the financial motivations behind these attacks.
To avoid falling victim to this type of malware, users should be wary of unexpected error messages prompting them to execute commands in PowerShell or other system tools. Vigilance and caution are key in protecting against these deceptive tactics, as the attackers rely on convincing users to act quickly without questioning the legitimacy of the instructions. This ongoing threat underscores the importance of cybersecurity awareness and proactive measures to safeguard against evolving cyber threats.
As of June 20, 2024, the cybersecurity community is actively monitoring this campaign and providing guidance on how users can defend against these malicious attacks. Stay informed and stay vigilant to protect yourself and your devices from potential security risks posed by these sophisticated cybercriminals.
Article Source
https://www.indiatoday.in/amp/technology/news/story/is-google-chrome-asking-you-to-copy-paste-code-beware-it-can-be-a-money-stealing-scam-2555656-2024-06-20