Be Aware: Fake Windows BSOD is Actually Malware

Important Points from ZDNET

Usually, encountering a Windows Blue or Black Screen of Death indicates a severe unrecoverable error. However, hackers are now exploiting this dreaded screen to deceive users into executing harmful software.

This new tactic involves using social engineering techniques named ClickFix, alongside fake CAPTCHA tests and fraudulent BSODs. These steps are designed to manipulate users into running malicious code by copying and pasting it, which subsequently installs a Russian-related Remote Access Trojan (RAT). This RAT enables cybercriminals to control the victim's computer remotely and deploy further malware.

Attack Mechanism Explained

The attack begins with a disguised phishing email. Posing as the online travel platform Booking.com, the email contains a link purportedly for cancelling a reservation, luring recipients to click it. Following the link opens a fraudulent webpage with a fake CAPTCHA, which then initiates the counterfeit BSOD.

The campaign leverages psychological manipulation to entice targets into executing commands or scripts on their devices. Specifically, it instructs users to resolve the fake BSOD by pasting a harmful script into the Windows run dialog.

Executing the aforementioned ClickFix trick commands a PowerShell script to download and execute an MSBuild project, v.proj. This malicious operation cleverly disables Windows Defender to evade detection and establishes persistence by placing itself in the startup directory, automatically running each time the system boots.

The final malware payload comprises an obscured version of a trojan that not only grants remote access but also can record keystrokes, execute rogue operations using legitimate processes, and download additional malicious content.

Targeted Campaign Insights

Cybercriminals count on several factors for the campaign's success. They launched it during the bustling holiday period for the hospitality sector and used Booking.com—previously exploited and well-known among scammers—as a ruse. The phishing messages listed room fees in euros, suggesting the primary targets were hotels in Europe. The presence of Russian in the 'v.project' file points to Russian attackers employing DCRat.

While this threat particularly pertains to businesses within the hospitality industry, the average household might remain unaffected. Nevertheless, institutions and individuals identified as targets can implement precautionary measures as advised by Securonix to combat these threats.