A new peril has surfaced as threat actors exploit fake Facebook job advertisements to propagate Ov3r_Stealer, a sophisticated Windows-based malware. Trustwave SpiderLabs’ recent findings reveal a multifaceted threat capable of stealing credentials and crypto wallets, siphoning IP address-based location, hardware info, passwords, and an array of sensitive data. The campaign’s origin involves weaponized PDFs, distributed through fake Facebook accounts and ads, tricking users into executing a PowerShell loader from a GitHub repository to launch Ov3r_Stealer. Strikingly similar to the recently disclosed Phemedrone Stealer, this malware raises questions about potential repurposing and shared code-level overlaps, emphasizing the need for heightened cybersecurity measures against evolving threats. These revelations coincide with cybercriminals advertising access to major organizations’ law enforcement request portals, showcasing the interconnected landscape of cyber threats. As we navigate the complexities of Ov3r_Stealer, vigilance becomes paramount in the face of cyber adversaries evolving their tactics.
https://thehackernews.com/2024/02/beware-fake-facebook-job-ads-spreading.html