Microsoft: Cyberattack Campaign Targets Users Watching Pirated Movies
Microsoft has disclosed a large-scale cyberattack campaign that abused malicious advertising (malvertising) on pirated movie streaming sites, infecting nearly 1 million devices worldwide with malware.
According to a report from Microsoft Threat Intelligence, the attack took place in December 2024 and targeted users visiting two sites, movies7 and 0123movie. The hackers inserted malicious code into video ads, which then automatically redirected users to malicious websites.
How the Malware Spreads Through Malicious Ads
1. Malicious Ads on Pirated Movie Sites
- When users watch videos on movies7 or 0123movie, the ads embedded in the video trigger a chain of malicious redirects.
- Hackers exploit pay-per-view or pay-per-click systems to make money from the ad platform.
2. Redirection to Scam Websites
- Users are redirected to fake websites, such as tech support scams or financial scam pages.
- From there, they are sent on to GitHub, where the malware files are hosted.
3. Downloading and Deploying the Malware
- Hackers use GitHub to distribute malicious files that infect users' computers.
- Microsoft identified and removed these repositories, but many devices had already been infected.
4. Malware Installation and Remote Control
- The malware collects system information and sends it back to the hackers' command-and-control server.
- A PowerShell script is executed to download NetSupport RAT (Remote Access Trojan), which lets hackers remotely control the infected device.
- The RAT then downloads Lumma Infostealer or Doenerium Infostealer, helping hackers steal personal data, documents, passwords, and browsing history.
Security Risks and How to Protect Yourself
The Threat From Malvertising Malware
- This malware can monitor browsing activity, interfere with the Chrome, Firefox, and Edge browsers, and even alter the content of web pages being displayed.
- The malicious files are digitally signed with legitimate certificates, which lets them slip past security tools easily.
- Microsoft revoked 12 digital certificates linked to this attack.
How to Protect Your Device From Malvertising Malware
- Do not visit pirated movie streaming sites, as they are an ideal environment for hackers to spread malware.
- Install antivirus software, especially programs that can detect malvertising and malicious redirects.
- Avoid clicking on ads from unknown sources, even when they appear on popular websites.
- Turn on Windows Defender or other security software to detect and block malicious programs.
- Update your operating system and browsers regularly so attackers cannot exploit security vulnerabilities.
According to Microsoft, Windows Defender can detect and block this type of malware, but users still need to stay alert when browsing the web. It is an important reminder to limit visits to platforms that violate copyright, where hackers are taking advantage to spread malware on a large scale.
