New 'WarmCookie' malware spreads in France through fake browser updates, posing a serious data threat. Learn how to stay protected from this backdoor
Continue reading
A new wave of cyber espionage, meticulously crafted through a strategy known as "FakeUpdate," has been targeting users in France, leveraging compromised websites to push fake update notifications for popular applications. At the heart of this operation is the sophisticated _"WarmCookie"_ backdoor, deployed by the elusive threat group, SocGolish.
By disguising itself as legitimate software updates, WarmCookie has gained an unprecedented reach, with the latest enhancements adding layers of complexity and danger to this backdoor.
First identified by cybersecurity firm eSentire in mid-2023, WarmCookie quickly distinguished itself with broad, multi-functional capabilities tailored to Windows systems.
Traditionally, it has spread through phishing emails, often masquerading as job offers. In the current campaign, however, WarmCookie is distributed via FakeUpdate attacks, where fake updates mimic widely trusted applications such as Google Chrome, Mozilla Firefox, Microsoft Edge, and Java.
The attackers behind WarmCookie are deploying this malware using highly convincing fake update prompts displayed on compromised websites. Once users click the prompts, WarmCookie is silently installed on their systems, enabling the threat actors to take control and harvest valuable data.
The technical intricacies of WarmCookie illustrate a calculated approach to data theft and remote control. Its capabilities include:
WarmCookie efficiently locates and exfiltrates files, focusing on sensitive data that can be monetized or weaponized for further attacks.
The malware gathers detailed information about the infected device’s configuration, including hardware, software, and network characteristics, essential for tailoring subsequent attack strategies.
By scanning the Windows Registry, WarmCookie identifies installed applications and system configurations, optimizing its actions based on the system environment.
WarmCookie can execute arbitrary commands, allowing the attackers to alter system files, modify permissions, or introduce additional malware.
The malware has built-in screenshot-capturing abilities, which are instrumental for gathering visual context on the target's activity.
Additional Payload Introduction: Beyond its core functions, WarmCookie serves as a delivery mechanism for secondary payloads, intensifying its impact on compromised systems.
These features not only reinforce WarmCookie’s versatility but also highlight the attackers' ability to adapt to various operational environments.
The current campaign, monitored by Gen Threat Labs, reveals that WarmCookie has been updated with new functionalities that expand its threat scope:
WarmCookie now stores and executes dynamic link libraries (DLLs) from temporary directories, complicating detection by traditional endpoint security solutions.
The backdoor can transfer and run EXE and PowerShell files on infected devices, an enhancement that gives the attackers direct, remote control over system processes.
The malware conducts anti-VM (virtual machine) checks to evade detection by analysts running virtualized environments, ensuring WarmCookie operates only in genuine user environments.
This set of advancements marks a significant evolution in WarmCookie’s architecture, enhancing its ability to persist on targeted systems and effectively resist forensic analysis.
The infection process is both seamless and deceptive. It starts with a fake update notification on a compromised or maliciously designed website.
Once a user clicks the prompt, JavaScript initiates the download of WarmCookie, disguised as a legitimate installer. This fake installer, once executed, installs WarmCookie on the system, often without visible alerts to the user.
*New WarmCookie Infection Chain (source: Gen Threat Labs)*
During installation, WarmCookie performs anti-VM checks to verify that it is running on a real machine rather than in a sandboxed or virtual environment. Once confirmed, it transmits a detailed fingerprint of the system to the command-and-control (C2) server, awaiting further commands. The process is seamless, and victims are typically unaware of the compromise.
This particular campaign by SocGolish primarily targets French users, exploiting trust in familiar brands like Chrome and Java.
Domains such as _"edgeupdate[.]com"_ and _"mozilaupgrade[.]com"_ have been utilized to replicate the visual elements of genuine updates, adding credibility to the prompts and making detection challenging for everyday users.
Given the sophistication of WarmCookie and the deceptive nature of FakeUpdate campaigns, vigilance is essential. Users should be reminded that:
Modern browsers update in the background, requiring only a restart in most cases. Manual updates should be verified directly through the official website of each software provider.
Fake update prompts can appear on seemingly trustworthy websites due to compromised content, so skepticism is warranted, even on familiar sites.
In this campaign, SocGolish’s calculated methods—targeting unsuspecting users with legitimate-seeming prompts and leveraging WarmCookie’s capabilities—reveal an elevated level of technical and psychological strategy.
Staying updated on the latest developments in malware campaigns like FakeUpdate is crucial for users and organizations alike, as WarmCookie’s expanding abilities demonstrate a clear trajectory toward even more targeted and persistent attacks in the future.
A single ClickFix infrastructure is pushing StealC, Amatera, Remus, NetSupport, CastleLoader and a new loader called ResiLoader through fake Google/Cloudflare checks.
