Fake AnyDesk Google ads deliver malware

Malware pushed through Google search results

Hackers are pushing a bogus version of a remote desktop app AnyDesk through search results on Google. The fake app contains a trojan that is part of a new campaign designed to control a victim's computer.

Researchers at CrowdStrike first spotted the malware last month. Researchers said the suspicious file masquerading as AnyDesk called "AnyDeskSetup.exe" was being written to disk and exhibiting suspicious behavior.

The executable wasn't a legitimate version but had been weaponized with additional capabilities. To evade detection by Google's advert security, the malware attempted to launch a PowerShell script that had been renamed rexc.exe to bypass detection.

Researchers reviewed the process and found "AnydeskSetup.exe'' running from the user's Downloads directory. They said this wasn't the normal version of the application, as it was signed by Digital IT Consultants Plus Inc. instead of AnyDesk creators, philandro Software GmbH. The network activity generated by the application was to a domain (anydeskstat[.]com) registered on April 9, 2021 and hosted at a Russian IP address.

When executed, a PowerShell implant was written to %TEMP/v.ps1 and executed with a command-line switch of "-W 1" to hide the PowerShell window. At this point, researchers launched a thorough investigation and found the PowerShell script the hackers used was similar to another piece of malware hiding as a Zoom installer in April.

Related Resource

Reduce management overhead by transforming VDI and app management

How to support a distributed workforce with VMware Horizon Control Plane

Reduce management overhead by transforming VDI and app management  - whitepaper from VMWareDownload now

"The logic we observed is very similar to logic observed and published by Inde, where a masqueraded Zoom installer dropped a similar PowerShell script from an external resource," said researchers.

The malvertising campaign itself sends victims to a URL clone of the legitimate AnyDesk website and provides a download link for the trojan installer. Researchers found three intermediary websites used in this campaign.

Researchers said the hackers are spending $1.75 per click, but this doesn't equate to getting a shell on a target they're interested in.

"While it is unknown what percentage of Google searches for AnyDesk resulted in clicks on the ad, a 40% Trojan installation rate from an ad click shows that this is an extremely successful method of gaining remote access across a wide range of potential targets," said researchers.

Researchers notified customers and alerted Google to the malvertising campaign. "It appears that Google expeditiously took appropriate action because, at the time of this blog, the ad was no longer being served," researchers said.

Featured Resources

Defeating ransomware with unified security from WatchGuard

How SMBs can defend against the onslaught of ransomware attacks

Free download

The IT expert’s guide to AI and content management

How artificial intelligence and machine learning could be critical to your business

Free download

The path to CX excellence

Four stages to thrive in the experience economy

Free download

Becoming an experience-based business

Your blueprint for a strong digital foundation

Free download

Recommended

Best MDM solutions 2020
mobile device management (MDM)

Best MDM solutions 2020

17 Sep 2021
How do hackers choose their targets?
hacking

How do hackers choose their targets?

17 Sep 2021
Owner of DDoS for hire sites found guilty of hacking offences
distributed denial of service (DDOS)

Owner of DDoS for hire sites found guilty of hacking offences

17 Sep 2021
Microsoft brings passwordless security to consumer accounts
Microsoft Windows

Microsoft brings passwordless security to consumer accounts

16 Sep 2021

Most Popular

Zoom: From pandemic upstart to hybrid work giant
video conferencing

Zoom: From pandemic upstart to hybrid work giant

14 Sep 2021
What are the pros and cons of AI?
machine learning

What are the pros and cons of AI?

8 Sep 2021
Google takes down map showing homes of 111,000 Guntrader customers
data breaches

Google takes down map showing homes of 111,000 Guntrader customers

2 Sep 2021