Nintendo and Steam Game but also Microsoft Office and Adobe Photoshop have been targeted by a malware called ChromeLoader… but only if you try to download for free Since 2022, there has been a steady increase in cases where disk image files, such as ISO and VHD, have been used in malware distribution.
In this regard, a new malware campaign called ChromeLoader has been observed distributed via VHD (Virtual Hard Disk) files, highlighting a deviation from the ISO disk image format.
“These VHD files are distributed with file names that make them appear to be hacks or cracks for Nintendo and Steam Games,” AhnLab Security Emergency Response Center (ASEC) said in a report, also listing some of the file names used for the hack, which are listed below:
ELDEN RING Free Download (v1_08_1).vhd
Dark Souls 3 [FitGirl Repack]_part1_rar.vhd
Red Dead Redemption 2 Free Download (v1_0_1436_28).
File vhd_ Need for Speed Carbon Collectors Edition____. vhd_ Call of Duty Deluxe Edition_zip ___.
File vhd_ Portal_2_v2023_01_17_zip ___.vhd
File_ Minecraft – Story Mode_Complete Season_zi___.vhd
[NEW] ROBLOX _ Doors Script _ Hack _ Spawn Entities___.vhd
The Legend of Zelda_ Breath of the Wild SWITCH ___.vhd
Pokemon Ultra Moon_ Update 1_2 [Decrypted] 3DS ___ (1) .vhd
Rossing-New-Horizons-Switch-NSPNSZXCI-U___.vhd
Mario Kart 8 Deluxe (NSP)(Booster Course DLC)(W___ (2).vhd
Super Mario Odyssey Switch NSP+ Free Update Dow___.vhd
Microsoft Office 2010 Free Download.vhd
Adobe Photoshop 2023 Download free.vhd
ChromeLoader (also known as Choziosi Loader or ChromeBack) originally came to prominence in January 2022, it is generally considered to be adware that as a credential stealer has the primary goal of intercepting web traffic and sending fraudulent advertisements. Since that January 2022, it has evolved into a more powerful and multi-faceted threat capable of stealing sensitive data, distributing ransomware, and even launching a zip bomb also called a zip of death. The malware’s primary goal is to compromise popular web browsers such as Google Chrome and modify browser settings to intercept and direct traffic to fraudulent advertising websites. Furthermore, ChromeLoader has rapidly evolved to focus on a conduit for click fraud, using a browser extension to force users to visit unwanted sites and generate pay-per-click advertising revenue. Since its arrival on the scene, the malware has gone through several iterations, many of which have the ability to infiltrate Windows and macOS systems.
The move to VHD files is another sign of the rapid evolution the malware has undergone in recent months. While the malware’s capabilities can cause significant collateral damage, it is the potential secondary and tertiary actions after infection that can make it so damaging.
The malware often hijacks the victim’s browser, and in turn, can also redirect the victim to unwanted websites. Additionally, the malware in some of its variants can compromise the security of a victim’s Internet browser, resulting in sensitive information such as passwords and credentials (both personal and corporate) being exposed to the malware and subsequently extracted for secondary gain. The infection chain indicates that users searching for pirated software and free video game download cheats are the primary targets, leading the unsuspecting person to download VHD files from fraudulent websites that appear on search results pages.
Some of the popular game titles and software used are Elden Ring, Dark Souls III, Red Dead Redemption 2, Need for Speed, Call of Duty, The Legend of Zelda: Breath of the Wild, Mario Kart 8 Deluxe, Super Mario Odyssey, Microsoft Office, and Adobe Photoshop.
“When a VHD file is downloaded through this process, the user can easily mistake the malicious VHD file for a program related to the desired game,” ASEC researchers said. “Disguising malware as hacked games and cracked programs is a method used by many hackers.” To avoid such risks, the only valid advice that can be given to users is to refrain from following suspicious links and download software only from official sources.
Nintendo and Steam Game but also Microsoft Office and Adobe Photoshop have been targeted by a malware called ChromeLoader… but only if you try to download for free Since 2022, there has been a steady increase in cases where disk image files, such as ISO and VHD, have been used in malware distribution.
In this regard, a new malware campaign called ChromeLoader has been observed distributed via VHD (Virtual Hard Disk) files, highlighting a deviation from the ISO disk image format.
“These VHD files are distributed with file names that make them appear to be hacks or cracks for Nintendo and Steam Games,” AhnLab Security Emergency Response Center (ASEC) said in a report, also listing some of the file names used for the hack, which are listed below:
ELDEN RING Free Download (v1_08_1).vhd
Dark Souls 3 [FitGirl Repack]_part1_rar.vhd
Red Dead Redemption 2 Free Download (v1_0_1436_28).
File vhd_ Need for Speed Carbon Collectors Edition____.
vhd_ Call of Duty Deluxe Edition_zip ___.
File vhd_ Portal_2_v2023_01_17_zip ___.vhd
File_ Minecraft – Story Mode_Complete Season_zi___.vhd
[NEW] ROBLOX _ Doors Script _ Hack _ Spawn Entities___.vhd
The Legend of Zelda_ Breath of the Wild SWITCH ___.vhd
Pokemon Ultra Moon_ Update 1_2 [Decrypted] 3DS ___ (1) .vhd
Rossing-New-Horizons-Switch-NSPNSZXCI-U___.vhd
Mario Kart 8 Deluxe (NSP)(Booster Course DLC)(W___ (2).vhd
Super Mario Odyssey Switch NSP+ Free Update Dow___.vhd
Microsoft Office 2010 Free Download.vhd
Adobe Photoshop 2023 Download free.vhd
ChromeLoader (also known as Choziosi Loader or ChromeBack) originally came to prominence in January 2022, it is generally considered to be adware that as a credential stealer has the primary goal of intercepting web traffic and sending fraudulent advertisements. Since that January 2022, it has evolved into a more powerful and multi-faceted threat capable of stealing sensitive data, distributing ransomware, and even launching a zip bomb also called a zip of death.
The malware’s primary goal is to compromise popular web browsers such as Google Chrome and modify browser settings to intercept and direct traffic to fraudulent advertising websites. Furthermore, ChromeLoader has rapidly evolved to focus on a conduit for click fraud, using a browser extension to force users to visit unwanted sites and generate pay-per-click advertising revenue. Since its arrival on the scene, the malware has gone through several iterations, many of which have the ability to infiltrate Windows and macOS systems.
The move to VHD files is another sign of the rapid evolution the malware has undergone in recent months. While the malware’s capabilities can cause significant collateral damage, it is the potential secondary and tertiary actions after infection that can make it so damaging.
The malware often hijacks the victim’s browser, and in turn, can also redirect the victim to unwanted websites. Additionally, the malware in some of its variants can compromise the security of a victim’s Internet browser, resulting in sensitive information such as passwords and credentials (both personal and corporate) being exposed to the malware and subsequently extracted for secondary gain. The infection chain indicates that users searching for pirated software and free video game download cheats are the primary targets, leading the unsuspecting person to download VHD files from fraudulent websites that appear on search results pages.
Some of the popular game titles and software used are Elden Ring, Dark Souls III, Red Dead Redemption 2, Need for Speed, Call of Duty, The Legend of Zelda: Breath of the Wild, Mario Kart 8 Deluxe, Super Mario Odyssey, Microsoft Office, and Adobe Photoshop.
“When a VHD file is downloaded through this process, the user can easily mistake the malicious VHD file for a program related to the desired game,” ASEC researchers said. “Disguising malware as hacked games and cracked programs is a method used by many hackers.” To avoid such risks, the only valid advice that can be given to users is to refrain from following suspicious links and download software only from official sources.