Spyware found stealing Iranian user data via infected VPN installer

Spyware has been discovered stealing Iranian users data via an infected VPN installer, antivirus provider Bitdefender has revealed.  The...

Spyware has been discovered stealing Iranian users data via an infected VPN installer, antivirus provider Bitdefender has revealed. 

The company's joint-research with cybersecurity firm Blackpoint found components of Iranian-made EyeSpy malware to be injected "through Trojanized installers of VPN software (also developed in Iran)."  

The majority of targets were within the country's borders, only a few victims were found to be based in Germany and the US. 

This is particularly concerning in a country like Iran, where using one the best VPN services has increasingly become a necessity. Whether this is for bypassing its strict online censorship, or preserving anonymity to avoid dangerous government surveillance. Most likely, a mix of both.  

At the same time, a harsh crackdown on Iranian VPN services might push people towards unsecure third-party vendor sites. This makes such a spyware campaign even more dangerous for Iranians' privacy and security.    

Anti-dissident spware?

"In light of the recent events, it’s possible that the targets are Iranians who want to access the internet via a VPN to bypass the country’s digital lockdown. Such malicious installers could plant spyware on people who pose a threat to the regime," Bitdefender's report noted. 

Developed by Iranian-based firm SecondEye, EyeSpy is a legit monitoring software sold to businesses as a way to monitor employees' activities working remotely.  

The attackers were observed using components of the legit application in a malicious way to infect users' downloading the Iranian-based VPN service 20Speed and spy on their activities.     

Once injected into a device, the malware can virtually spy on every activity and collect a tons of sensitive data. These include stored passwords, crypto-wallet data, documents and images, contents from clipboard, and logs key presses. 

"The components of the malware are scripts that steal sensitive information from the system and upload them to an FTP server belonging to SecondEye," Bitdefender explained.

"This can lead to complete account takeovers, identity theft and financial loss. Moreover, by logging keypresses, attackers can obtain messages typed by the victim on social media or e-mail, and this information can be used to blackmail the victims." 

The campaign appears to be active since May 2022, with a growing number of attacks following the wave of anti government protests began in September.  

VPN downloads in Iran skyrocketed following this, reaching a peak of more than 3,000% increase by the end of the month. 

A VPN is largely used by Iranian citizens to access restricted apps like Instagram and WhatsApp. But, as the government increasingly charges dissidents with harsh sentences even reaching the death penalty, extra security software is also a necessity to safeguard sensitive data.

While more and more Iranians download a virtual private network on their devices, authorities are hardly cracking down on reliable VPN services as a result. 

Many providers are currently blocked in Iran, meaning that third-party VPN installers are increasingly in popularity. According to Iran International, 20Speed VPN is actually one of the most popular websites where Iranians head to buy their VPN subscriptions. Over 100,000 are the active installations of its Android VPN app.

To fight against such malware campaigns, Bitdefender's experts recommend "using well-known VPN solutions downloaded from legitimate sources. Also, a security solution, like Bitdefender, can protect against information stealers."

from TechRadar - All the latest technology news https://ift.tt/qLcOdZ4



Apps,3858,Business,151,Camera,1155,Earn $$$,3,Gadgets,1741,Games,926,GTA,1,Innovations,3,Mobile,1697,Paid Promotions,5,Promotions,5,Sports,1,Technology,8106,Trailers,796,Travel,37,Trending,4,Trendly News,24922,TrendlyNews,8,Video,5,XIAOMI,13,YouTube - 9to5Google,7,
Trendly News | #ListenNow #Everyday #100ShortNews #TopTrendings #PopularNews #Reviews #TrendlyNews: Spyware found stealing Iranian user data via infected VPN installer
Spyware found stealing Iranian user data via infected VPN installer
Trendly News | #ListenNow #Everyday #100ShortNews #TopTrendings #PopularNews #Reviews #TrendlyNews
Loaded All Posts Not found any posts VIEW ALL Readmore Reply Cancel reply Delete By Home PAGES POSTS View All RECOMMENDED FOR YOU LABEL ARCHIVE SEARCH ALL POSTS Not found any post match with your request Back Home Sunday Monday Tuesday Wednesday Thursday Friday Saturday Sun Mon Tue Wed Thu Fri Sat January February March April May June July August September October November December Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec just now 1 minute ago $$1$$ minutes ago 1 hour ago $$1$$ hours ago Yesterday $$1$$ days ago $$1$$ weeks ago more than 5 weeks ago Followers Follow THIS PREMIUM CONTENT IS LOCKED STEP 1: Share. STEP 2: Click the link you shared to unlock Copy All Code Select All Code All codes were copied to your clipboard Can not copy the codes / texts, please press [CTRL]+[C] (or CMD+C with Mac) to copy