iverify.io - Android malware-as-a-service platforms like PhantomOS and Nebula offer powerful malware kits and scalable distribution tools, no technical skills required.

With new malware-as-a-service (MaaS) platforms like PhantomOS and Nebula, cybercriminals can now attack Android devices more easily than ever. You don't have to write any code. Attackers can buy ready-to-use malware kits for as little as $300 a month. Some of these kits come with features 2FA interception, the ability to bypass antivirus software, silent app installs, GPS tracking, and even phishing overlays that are specific to a brand. The platforms come with everything they need, like support through Telegram, backend infrastructure, and built-in ways to get around Google Play Protect. This change is like what happened when ransomware-as-a-service (RaaS) first came out. These threats are no longer just for skilled cybercriminals. Anyone with a Telegram account and a few hundred dollars can get them now.

Malware Campaigns, No Skills Required
In the past, running an Android banking trojan or spyware campaign required expertise – one had to set up command-and-control servers, manage cryptographic signing of malicious apps, test against antivirus, and so on. Now, much of that heavy lifting is handled by the MaaS operators. Criminal customers simply pay a fee and receive a ready-to-deploy malicious APK, often customized to their needs.

Consider PhantomOS, a recent MaaS offering geared toward fraudsters. PhantomOS is marketed as “the world’s most powerful Android APK malware-as-a-service”. Its feature set reads like a penetration tester’s wish list: remote silent installation of apps onto the victim’s device, interception of SMS messages and one-time passcodes (OTP) for 2FA, the ability to remotely hide the malicious app to prevent the victim from removing it, and even an overlay system that loads phishing pages inside the app’s interface.

bleepingcomputer.com - The Lumma infostealer malware operation is gradually resuming activities following a massive law enforcement operation in May, which resulted in the seizure of 2,300 domains and parts of its infrastructure.

Although the Lumma malware-as-a-service (MaaS) platform suffered significant disruption from the law enforcement action, as confirmed by early June reports on infostealer activity, it didn't shut down.

The operators immediately acknowledged the situation on XSS forums, but claimed that their central server had not been seized (although it had been remotely wiped), and restoration efforts were already underway.

Gradually, the MaaS built up again and regained trust within the cybercrime community, and is now facilitating infostealing operations on multiple platforms again.

According to Trend Micro analysts, Lumma has almost returned to pre-takedown activity levels, with the cybersecurity firm's telemetry indicating a rapid rebuilding of infrastructure.

"Following the law enforcement action against Lumma Stealer and its associated infrastructure, our team has observed clear signs of a resurgence in Lumma's operations," reads the Trend Micro report.

"Network telemetry indicates that Lumma's infrastructure began ramping up again within weeks of the takedown."

Apple's macOS has been under siege in 2024 as malware-as-a-service platforms and AI-driven threats make the year a turning point for Mac security.

Ontinue Cyber Defenders have observed an uptick in activities related to the LummaC2 infostealer being used as a Malware-as-a-Service.

Cado Security has identified a malware-as-a-service (MaaS) targeting macOS users named “Cthulhu Stealer”.

The Lumma information-stealing malware is now using an interesting tactic to evade detection by security software - the measuring of mouse movements using trigonometry to determine if the malware is running on a real machine or an antivirus sandbox.

Cyber threat intelligence largely involves the tracking and studying of the adversaries outside of your network. Gaining counterintelligence about your adversaries' capabilities and weaponry is one of the final building blocks for managing a strong cyber defense. In the pursuit of performing this duty, I have been studying how to discover adversary infrastructure on the internet. One good way of doing this has been via leveraging the scan data available through the popular Shodan search engine. If you've not used it before, Shodan periodically scans the entire internet and makes it available for users to query through. It is often used to monitor networks, look for vulnerabilities, and ensure the security of an organization's perimeter.

Since September 2022, Aurora malware is advertised as an infostealer and several traffers teams announced they added it to their malware toolset.

Raccoon is a malware family that has been sold as malware-as-a-service on underground forums since early 2019. In early July 2022, a new variant of this malware was released. The new variant, popularly known as Raccoon Stealer v2, is written in C unlike previous versions which were mainly written in C++.

Numerosi rapporti ci suggeriscono che gli attacchi basati su codici malevoli rappresentano la maggioranza delle offensive cui osserviamo, tra esse la fanno da padrona i ransomware e gli info-stealer, questi ultimi sono malware concepiti per rubare un gran numero di informazioni dai sistemi infetti. Premesso ciò, chiediamoci quale sia la disponibilità sul mercato criminale di questi strumenti, quali siano i costi ed il modello di vendita.