A new phishing campaign is haunting jobseekers in the latest report. Cybersecurity experts revealed that WARMCOOKIE can bypass networks by luring users into clicking recruitment-themed emails. This, in turn, will be the key to deploying more malicious payloads.

This campaign, tracked by Elastic Security Labs under the moniker REF6127, has a sinister capability to capture screenshots on top of its usual task of delivering extra malware.

WARMCOOKIE Backdoor Capabilities

WARMCOOKIE functions as an initial backdoor tool designed to infiltrate victim networks and deploy further malicious software.

Elastic Security Labs' researcher Daniel Stepanic explains that each WARMCOOKIE sample includes a hard-coded command-and-control (C2) IP address and RC4 encryption key. The backdoor is capable of:

• Fingerprinting infected machines

• Capturing screenshots

• Deploying additional malware

Related Article: Go-Based Backdoor Hits Russian Orgs: New Password-Stealing Variant?

Attack Chain and Delivery Mechanism

Since late April, the phishing campaign has used emails purporting to be from well-known recruitment firms such as Hays, Michael Page, and PageGroup. These emails urge recipients to click on a link to view job opportunities.

Once users click the link, they are prompted to solve a CAPTCHA challenge, which leads to the download of a JavaScript file named "Update_23_04_2024_5689382.js."

"This obfuscated script runs PowerShell, initiating the process to load WARMCOOKIE," notes Elastic. The PowerShell script exploits the Background Intelligent Transfer Service (BITS) to download the WARMCOOKIE backdoor.

How the Backdoor Emerges

A crucial component of this campaign is the use of compromised infrastructure to host the initial phishing URL. This URL redirects victims to the appropriate landing page, where the malicious payload is delivered. The WARMCOOKIE backdoor follows a two-step process to establish persistence:

1. Creating a scheduled task to ensure the backdoor runs continuously

2. Launching its core functionality after performing anti-analysis checks to evade detection

Similarities to Previous Campaigns

WARMCOOKIE's behavior resembles artifacts from a previous campaign codenamed Resident, which targeted manufacturing, commercial, and healthcare sectors. The backdoor can:

• Read from and write to files

• Execute commands using cmd.exe

• Retrieve a list of installed applications

• Capture screenshots

WARMCOOKIE Might Be New But it's Gaining Traction Already

Elastic Security Labs emphasizes that WARMCOOKIE is a newly discovered backdoor gaining traction in global phishing campaigns.

The disclosure of this campaign coincides with Trustwave SpiderLabs' report on another phishing campaign using invoice-related decoys and Windows search functionality embedded in HTML code to deploy malware.

Advanced Phishing Techniques

According to The Hacker News, phishing emails in this new campaign contain a ZIP archive with an HTML file. This file uses the legacy Windows "search:" URI protocol handler to display a Shortcut (LNK) file hosted on a remote server in Windows Explorer, making it appear as a local search result.

Clicking the LNK file triggers a batch script (BAT) hosted on the same server, potentially initiating further malicious actions.

Trustwave notes that it could not retrieve the batch script due to an unresponsive server. However, the misuse of search-ms: and search: as malware distribution vectors was previously documented by Trellix in July 2023.

The ongoing phishing campaign utilizing WARMCOOKIE is a sign that cybercriminals won't show any signs of slowing down when it comes to innovating new tactics to catch more victims off guard.

Attackers aim to infiltrate networks and deploy additional malicious payloads in this scheme. To avoid this from happening, stay away from untrusted links from suspicious sources.

In other news, the GTPDOOR Linux backdoor can expose your IP address. Without seeing any signs of attack, it can secretly infiltrate the mobile carrier network.

Read Also: ColdRiver Russian Hackers: New Spica Backdoor Malware Uses Payloads to Disguise as PDF Decryption Tool