The Russia-linked risk actor often known as COLDRIVER has been noticed distributing a brand new malware referred to as LOSTKEYS as a part of an espionage-focused marketing campaign utilizing ClickFix-like social engineering lures.
“LOSTKEYS is able to stealing information from a hard-coded listing of extensions and directories, together with sending system info and operating processes to the attacker,” the Google Menace Intelligence Group (GTIG) stated.
The malware, the corporate stated, was noticed in January, March, and April 2025 in assaults on present and former advisors to Western governments and militaries, in addition to journalists, suppose tanks, and NGOs. As well as, people related to Ukraine have additionally been singled out.
LOSTKEYS is the second customized malware attributed to COLDRIVER after SPICA, marking a continued departure from the credential phishing campaigns the risk actor has been recognized for. The hacking group can also be tracked underneath the names Callisto, Star Blizzard, and UNC4057.
“They’re recognized for stealing credentials and after having access to a goal’s account they exfiltrate emails and steal contact lists from the compromised account,” safety researcher Wesley Shields stated. “In choose circumstances, COLDRIVER additionally delivers malware to focus on gadgets and should try and entry information on the system.”
The most recent set of assaults commences with a decoy web site containing a faux CAPTCHA verification immediate, the place victims are instructed to open the Home windows Run dialog and paste a PowerShell command copied to the clipboard, a broadly fashionable social engineering method dubbed ClickFix.
The PowerShell command is designed to obtain and execute the following payload from a distant server (“165.227.148[.]68”), which acts as a downloader for a third-stage however not earlier than performing checks in a possible effort to evade execution in digital machines.
A Base64-encoded blob, the third-stage payload is decoded right into a PowerShell script that is liable for executing LOSTKEYS on the compromised host, permitting the risk actor to reap system info, operating processes, and information from a hard-coded listing of extensions and directories.
Like within the case of SPICA, it has been assessed that the malware is simply deployed selectively, indicative of the highly-targeted nature of those assaults.
Google additionally stated it uncovered further LOSTKEYS artifacts going again to December 2023 that masqueraded as binaries associated to the Maltego open-source investigation platform. It is not recognized if these samples have any ties to COLDRIVER, or if the malware was repurposed by the risk actors beginning January 2025.
ClickFix Adoption Continues to Develop
The event comes as ClickFix continues to be steadily adopted by a number of risk actors to distribute a variety of malware households, together with a banking trojan referred to as Lampion and Atomic Stealer.
Assaults propagating Lampion, per Palo Alto Networks Unit 42, use phishing emails bearing ZIP file attachments as lures. Current inside the ZIP archive is an HTML file that redirects the message recipient to a faux touchdown web page with ClickFix directions to launch the multi-stage an infection course of.
“One other attention-grabbing side of Lampion’s an infection chain is that it’s divided into a number of non-consecutive phases, executed as separate processes,” Unit 42 stated. “This dispersed execution complicates detection, because the assault circulation doesn’t type a readily identifiable course of tree. As a substitute, it contains a posh chain of particular person occasions, a few of which may seem benign in isolation.”
The malicious marketing campaign focused Portuguese-speaking people and organizations in numerous sectors, together with authorities, finance, and transportation, the corporate added.
In current months, the ClickFix technique has additionally been mixed with one other sneaky tactic referred to as EtherHiding, which includes utilizing Binance’s Good Chain (BSC) contracts to hide the next-stage payload, in the end resulting in the supply of a macOS info stealer referred to as Atomic Stealer.
“Clicking ‘I am not a robotic’ triggers a Binance Good Contract, utilizing an EtherHiding method, to ship a Base64-encoded command to the clipboard, which customers are prompted to run in Terminal through macOS-specific shortcuts (⌘ + House, ⌘ + V),” an unbiased researcher who goes by the alias Badbyte stated. “This command downloads a script that retrieves and executes a signed Mach-O binary, confirmed as Atomic Stealer.”
Additional investigation has discovered that the marketing campaign has possible compromised about 2,800 professional web sites to serve faux CAPTCHA prompts. The big-scale watering gap assault has been codenamed MacReaper by the researcher.
“The assault leverages obfuscated JavaScript, three full-screen iframes, and blockchain-based command infrastructure to maximise infections,” the researcher added.