More than 1,300 fake AnyDesk sites found pushing malware

computing

(Image credit: Elchinator from Pixabay )

A major impersonation campaign is aiming to distribute the Vidar infostealer to as many endpoints as possible. 

Cybersecurity researcher from SEKOIA, going under the name crep1x, discovered the campaign and rang the alarm on Twitter. In a short Twitter threat, the researcher said he discovered more than 1,300 domains, all of which impersonate major software brands to push the malware (opens in new tab). 

The brands impersonated in this campaign include AnyDesk, MSI Afterburner, 7-ZIP, Blender, Dashlane, Slack, VLC, OBS, and cryptocurrency trading apps, to name a few. All of these impersonated brands lead to the same website, a clone of AnyDesk.

Stealing passwords and cryptocurrency

For the uninitiated, AnyDesk is a remote desktop application that gives users remote access to personal computers and allows them to transfer files and be used as a VPN. 

Victims that navigate to these sites and try to download the application would be redirected to a Dropbox folder hosting the Vidar infostealer. A variant of the Arkei infostealer, Vidar is capable of stealing credit cards, login credentials, files, and grab screenshots. It is also capable of stealing cryptocurrencies, such as bitcoin or ether, from the victim’s hot wallets (software wallets). 

Read more

> Vidar spyware is now hidden in Microsoft help files
> This fake GIMP Google ad just ends up serving malware
> This is the best endpoint protection software right now (opens in new tab)

According to BleepingComputer, which reported on crep1x’s findings earlier this week, the campaign is still active and many of the typosquatted domains are still active. Some have been shut down in the meantime. Dropbox was also notified of its services being abused to distribute malware and has killed the link in the meantime. 

However, given that all of the malicious sites point to the same place, the threat actors can persist easily by simply updating the download URL.

The best way to protect against such attacks is to be extra careful when downloading software and making sure the apps are only obtained from verified sources. That being said, navigating to the AnyDesk website (as opposed to clicking a supposed AnyDesk link in an email or a social media post) is a good place to start.

    Via: BleepingComputer (opens in new tab)

    Are you a pro? Subscribe to our newsletter

    Sign up to theTechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!

    By submitting your information you agree to the Terms & Conditions (opens in new tab) and Privacy Policy (opens in new tab) and are aged 16 or over.

    Sead Fadilpašić

    Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

    TECH NEWS RELATED

    This Tiny MSI PC is Packed With Power

    MSI Following the example set by the Mac Mini, many Windows-powered compact PCs have popped up recently with solid hardware. If none have quite caught your eye, though, maybe this PC by MSI will. MSI has just released a new tiny PC called the Cubi 5 12M, and it’s ...

    View more: This Tiny MSI PC is Packed With Power

    Logitech’s New Colorful Keyboards and Mice Look Great

    Logitech Logitech makes some of the best keyboards and best mice around, and you might be familiar with the company’s RGB-packed gaming products. These new peripherals are really packed with color, but we’re not really talking about lights. Logitech has announced a range of new colors for a bunch ...

    View more: Logitech’s New Colorful Keyboards and Mice Look Great

    “Part of the Journey Is the End;” Marvel’s Avengers Seems to be Shutting Down

    Whether it be purely the lackluster quality of the game or the general distaste for live service games, Marvel’s Avengers never truly found its footing in the two years since it was released. Despite the fact that both the Marvel and Avengers labels should guarantee a happy, comic-lover audience, ...

    View more: “Part of the Journey Is the End;” Marvel’s Avengers Seems to be Shutting Down

    Satechi Thunderbolt 4 Slim Hub review: A sleek and portable laptop hub

    Thunderbolt 4 docks are now much more widely available, meaning that it’s much easier to get a high speed dock that works with your laptop. But unfortunately, while they’re relatively widely available now, they’re still quite expensive. Thankfully, however, that price seems to now be coming down a little through ...

    View more: Satechi Thunderbolt 4 Slim Hub review: A sleek and portable laptop hub

    Wi-Fi routers are being hit by a dangerous new Android malware with extra DNS hacks

    With the DNS changed, users are redirected to malicious pages

    View more: Wi-Fi routers are being hit by a dangerous new Android malware with extra DNS hacks

    Servant unleashes a bed bug blitz [Apple TV+ recap]

    Just when you thought things couldn't get any worse … bed bugs! Photo: Apple TV+ Dorothy is back in the bizarre Turner household this week on Apple TV+ thriller Servant — and she’s not happy to be home. Leanne insists on normalcy, but considering the things that have happened, ...

    View more: Servant unleashes a bed bug blitz [Apple TV+ recap]

    Hostinger quietly shutters Zyro to focus on Hostinger Website Builder service

    Will Zyro website builder still exist soon?

    View more: Hostinger quietly shutters Zyro to focus on Hostinger Website Builder service

    Redmi Note 12 Turbo Tipped to get Snapdragon 7-series SoC

    The Xiaomi Redmi Note 12 Series arrived in China and India last year. With that being said, we might see another offering in the Redmi Note series phone in the coming months where it will be powered by the Snapdragon 7-series chipset onboard. The information comes from a notable ...

    View more: Redmi Note 12 Turbo Tipped to get Snapdragon 7-series SoC

    Avatar 2 animators tricked James Cameron into believing some shots were practical

    Super Bowl 2023 live stream: how to watch the game, commercials and halftime show from anywhere

    The Minecraft Community Answers the Age-old Question: “Can it Run Doom?”

    Mark Hamill Hints That His Time as the Joker Is Over

    Deadpool joins Marvel's Midnight Suns next week, adding new story missions

    Chic-Fil-A’s Training Program Apparently Features a Familiar Fallout Face

    Nintendo is reportedly increasing Switch production ahead of Breath of the Wild 2

    Ex-Halo dev believes those who pushed for a better game ‘got laid off for it’

    There are two clear winners in the PSVR 2 launch lineup

    A nuclear-powered data center is opening this year

    Anker’s New Monitor Stand Doubles as an All-In-One Docking Station

    Naked Elden Ring Player Counter’s Placidusax’ Attack With Chaotic Results

    OTHER TECH NEWS

    Top Car News Car News