Hackers are pushing a bogus version of a remote desktop app AnyDesk through search results on Google. The fake app contains a trojan that is part of a new campaign designed to control a victim's computer.
Researchers at CrowdStrike first spotted the malware last month. Researchers said the suspicious file masquerading as AnyDesk called "AnyDeskSetup.exe" was being written to disk and exhibiting suspicious behavior.
The executable wasn't a legitimate version but had been weaponized with additional capabilities. To evade detection by Google's advert security, the malware attempted to launch a PowerShell script that had been renamed rexc.exe to bypass detection.
Researchers reviewed the process and found "AnydeskSetup.exe'' running from the user's Downloads directory. They said this wasn't the normal version of the application, as it was signed by Digital IT Consultants Plus Inc. instead of AnyDesk creators, philandro Software GmbH. The network activity generated by the application was to a domain (anydeskstat[.]com) registered on April 9, 2021 and hosted at a Russian IP address.
When executed, a PowerShell implant was written to %TEMP/v.ps1 and executed with a command-line switch of "-W 1" to hide the PowerShell window. At this point, researchers launched a thorough investigation and found the PowerShell script the hackers used was similar to another piece of malware hiding as a Zoom installer in April.
Reduce management overhead by transforming VDI and app management
How to support a distributed workforce with VMware Horizon Control Plane
"The logic we observed is very similar to logic observed and published by Inde, where a masqueraded Zoom installer dropped a similar PowerShell script from an external resource," said researchers.
The malvertising campaign itself sends victims to a URL clone of the legitimate AnyDesk website and provides a download link for the trojan installer. Researchers found three intermediary websites used in this campaign.
Researchers said the hackers are spending $1.75 per click, but this doesn't equate to getting a shell on a target they're interested in.
"While it is unknown what percentage of Google searches for AnyDesk resulted in clicks on the ad, a 40% Trojan installation rate from an ad click shows that this is an extremely successful method of gaining remote access across a wide range of potential targets," said researchers.
Researchers notified customers and alerted Google to the malvertising campaign. "It appears that Google expeditiously took appropriate action because, at the time of this blog, the ad was no longer being served," researchers said.
