BazarLoader malware abuses Windows 10 apps in 'Call Me Back' attack

A new phishing campaign is abusing an app feature in Windows 10 to spread the BazarLoader malware.

The campaign’s discovery came when employees started receiving the malware-laden emails, according to security researchers at Sophos.

One email appeared to be sent by a "Sophos Main Manager Assistant” called "Adam Williams.” In the email, the person demanded to know why the recipient hadn't responded to a customer's complaint, which appeared as a PDF link in the email.

However, if a victim clicked on the link, it downloaded and installed the BazarLoader malware. Researchers said this malware was delivered by abusing a novel mechanism, the Windows 10 apps installer process.

The researchers said the phishing campaign sends victims to a website sporting the Adobe logo to look more legitimate. The text on the page asks victims to click on a link to preview the alleged PDF.

“But there’s something amiss with this link: Instead of being prefixed with the expected https:// the link instead begins with what was (for me, at least) an unfamiliar ms-appinstaller: prefix,” said SophosLabs Principal Researcher Andrew Brandt.

"In the course of running through an actual infection I realized that this construction of a URL triggers the browser [in my case, Microsoft's Edge browser on Windows 10], to invoke a tool used by the Windows Store application, called AppInstaller.exe, to download and run whatever's on the other end of that link," he added.

This link points to a 482-byte text file named Adobe.appinstaller. The contents of that file are just plain text, in XML format, that points to a URL where a larger file containing the malware, named Adobe_1.7.0.0_x64.appbundle, was located.

The malicious appinstaller indicates the .appxbundle was digitally signed by a UK-based company calling itself Systems Accounting Limited. This certificate was issued several months ago, and Sophos contacted Sectigo to alert it about this abuse of the certificate it issued.

Victims then get asked to allow an "Adobe PDF Component” install. If this is allowed, Bazarloader is installed.

“Malware that comes in AppX packages is novel, but now that the process has been demonstrated, it’s likely to be here to stay. These apps are supposed to be digitally signed with certificates, but it doesn’t appear that there’s any mechanism to make a sanity check between what’s on the certificate and the code it’s supposed to certify,” said Brandt.