Riding the hype for new Arc browser. [Rsearch Saturday]
Jun 8, 2024
auto_awesome
Jérôme Segura, Senior Director of Threat Intelligence at Malwarebytes discusses how cybercriminals are exploiting the hype around the new Arc browser by distributing malware through deceptive Google search ads. They use techniques like embedding malware in image files and utilizing the MEGA cloud platform, emphasizing the need for caution with sponsored search results and the effectiveness of Endpoint Detection and Response systems.
Cybercriminals exploit Arc browser hype through deceptive Google search ads, distributing malware disguised as the browser.
Implementing DNS filtering and centralized software repositories can enhance security against malicious ad campaigns.
Deep dives
Attack Using Fake Browser Ads
Threat actors exploit Google search ads to lure users searching for legitimate software like Arc browser. By creating convincing ads with legitimate-looking URLs and logos, users are misled into clicking. These ads redirect users to malicious sites with subtly altered domain names, a tactic known as typosquatting. Once clicked, users unknowingly download and install malware disguised as the desired software.
Google Ad Vulnerabilities Exploited
Malicious actors abuse Google Ads features to deceive users. By manipulating the display URL and tracking templates, attackers redirect users to phony websites after clicking on legitimate-looking ads. These tactics make it challenging for users to discern between genuine and malicious sites, exploiting Google's ad infrastructure to propagate cyber threats.
Mitigation Strategies for Organizations
Organizations can enhance security by providing centralized repositories for essential software, reducing the need for users to search and download from potentially malicious sources. Implementing DNS filtering can also mitigate risks associated with malicious ads without relying on browser extensions. By proactively managing the risk surface, organizations can protect against deceptive ad campaigns targeting unsuspecting users.
Jérôme Segura, Senior Director of Threat Intelligence at Malwarebytes, is discussing their work on "Threat actors ride the hype for newly released Arc browser." The Arc browser, newly released for Windows, has quickly garnered positive reviews but has also attracted cybercriminals who are using deceptive Google search ads to distribute malware disguised as the browser.
These malicious campaigns exploit the hype around Arc, using techniques like embedding malware in image files and utilizing the MEGA cloud platform for command and control, highlighting the need for caution with sponsored search results and the effectiveness of Endpoint Detection and Response (EDR) systems.