Researchers Observe New ‘Paste And Run’ Phishing Campaign

Commands load DarkGate malware on infected systems while pretending to load offline copy of email attachment.

by Alan J June 6th, 2024

Share on LinkedInShare on Twitter

Security researchers have uncovered a new phishing campaign that attempts to trick recipients into pasting (CTRL+V) and executing malicious commands on their system. It leverages a sophisticated attack chain along with what the researchers have dubbed the “paste and run” technique.

‘Paste and Run’ Phishing Technique

The attackers behind the campaign send emails to potential victims purporting to be from legitimate businesses or organizations. Researchers from AhnLab stated that these emails often involve topics such as fee processing or operational instructions to entice recipients into opening attached files. The emails contain a file attachment with disguised intent, as in the examples below.

Source: asec.ahnlab.com

Once the victim clicks on the HTML attachment, a fake message displays in the browser while disguising itself as a Microsoft Word document. This message directs the user to click on a “How to fix” button that purports to help them load the document offline. After clicking the button, a set of instructions prompt the user to type out a set of keyboard commands—first type [Win+R], then [Ctrl+V], and press [Enter].

Source: asec.ahnlab.com

The button may alternatively load a different set of instructions directing the user to manually access the Windows PowerShell terminal and hit right-click within the terminal window. By following the instructions, the victim inadvertently pastes a malicious script to the terminal, which then executes in their system.

Phishing Scheme Installs DarkGate Malware

The PowerShell script downloaded and executed by the scheme is a component of the DarkGate malware family. Once the script is run, it downloads and executes an HTA (HTML Application) file from a remote command-and-control server.

The HTA file then executes additional instructions to launch an AutoIt3.exe file while passing a malicious AutoIt script (script.a3x) as an argument. The script appears to load the DarkGate malware to infect the system while also clearing the user’s clipboard to conceal the execution of malicious commands.

“The overall operation flow from the reception of the email to the infection is quite complex, making it difficult for users to detect and prevent,” the researchers noted.

Source: asec.ahnlab.com

Protecting Against the Phishing Campaign

The researchers advised email recipients to remain cautious when handling unsolicited emails, even if they appear to be from legitimate sources, to avoid falling victim to the phishing campaign. Recipients should refrain from opening attachment files or clicking on links until they can verify the email sender and its content.

“Users must take extra caution when handling files from unknown sources, especially the URLs and attachments of emails,” the researchers emphasized.

Additionally, recipients should also be wary of any messages that prompt them to execute commands, as it is a common tactic used by attackers to compromise systems. Upon receiving such requests, it is recommended to either ignore the email or report it to your organization’s IT security team.

The researchers also shared various indicators of compromise (IOCs) such as Base64-encoded PowerShell commands, HTA files, and Autoit scripts, download URLs, file signatures and behavioral indicators associated with the campaign.


Leave a Reply

Your email address will not be published. Required fields are marked *

Back to top button