PLAYFULGHOST Malware: Trojanized VPN Apps Used in Sophisticated Cyber Attacks

Cybersecurity researchers have discovered a powerful malware called PLAYFULGHOST. It boasts an arsenal of spying capabilities, including keylogging, screen capture, audio recording, and file manipulation. Google’s Managed Defense team discovered this malware. PLAYFULGHOST has similar functions to the notorious Gh0st RAT, whose source code was leaked in 2008. However, this new strain is far more sophisticated and has been weaponized through phishing emails and SEO poisoning techniques. Moreover, it targets unsuspecting users through compromised VPN apps like LetsVPN.

How Trojanized VPN Apps Are Spreading the Dangerous PLAYFULGHOST Malware?

PLAYFULGHOST uses tricky methods to infiltrate victims’ systems. One phishing campaign tricks users into extracting a malicious RAR archive disguised as a harmless image file. Once opened, the malware downloads and installs PLAYFULGHOST from a remote server. On the contrary, SEO poisoning misleads users into downloading trojanized VPN installers for LetsVPN. Upon execution, these compromised installers deploy interim payloads that eventually retrieve and load PLAYFULGHOST into memory. Attackers use DLL hijacking and side-loading techniques to infiltrate malicious code into legitimate processes, evading detection.

Extensive Features for Espionage and Sabotage

PLAYFULGHOST is built for endurance and stealth. It can entrench itself into a system using Run registry keys, scheduled tasks, and the Windows Startup folder, ensuring it remains active even after reboots. Its capabilities extend beyond espionage, allowing attackers to:

• Capture keystrokes, screenshots, and audio.
• Harvest system metadata and account details, including QQ and messaging profiles.
• Wipe clipboard content and delete browser caches for Chrome, Firefox, and QQ.
• Perform file operations and block mouse and keyboard inputs.

Moreover, it deploys tools like Mimikatz for credential theft and a rootkit to hide its presence. The malware also integrates an open-source utility called Terminator, which exploits vulnerable drivers to disable security processes.

Checkout: Huawei Mate XTs: The World’s First Triple-Screen Foldable Phone Gets a Successor – PhoneWorld