Beware of This Deceptive Windows BSOD Scheme

Typically, when you encounter a Windows Blue Screen of Death (BSOD), it signals a critical error that requires attention. However, cybercriminals are now manipulating this warning to get unsuspecting individuals to install malware.

Recently, bad actors have adopted strategies such as ClickFix social engineering, deceptive CAPTCHA tests, and counterfeit BSODs to prompt victims into executing harmful code. Once this code is initiated, it infiltrates the system with a Remote Access Trojan (RAT) tied to Russian operations, allowing for covert takeover.

Dissecting the Attack Method

The deceptive scheme kicks off with a phishing email masquerading as a communication from an online travel platform like Booking.com. Posing as a cancellation request, this email urges the recipient to engage by following a link. Landing on a site with a fake CAPTCHA, victims soon face a fabricated BSOD.

Subsequently, the attack relies on notorious tactics, coaxing users into self-infection by instructing them to execute certain commands. Users, believing they are correcting the BSOD, inadvertently paste and run harmful scripts via the Windows run dialog.

Engaging with the ClickFix scheme involves executing a PowerShell command, downloading, and launching an MSBuild file named v.proj. This malicious software can disable Windows Defender without detection and ensure persistence by embedding itself in the system's startup.

At its endpoint, the malware delivers an encoded version of a trojan capable of opening backdoor access, recording keyboard inputs, executing rogue processes under legitimate cover, and deploying further infections.

The perpetrators bank on two main strategies for success: the timing aligns with bustling holiday periods in the hotel industry, and the misuse of Booking.com, a frequent scam target. Phishing emails feature room rates in euros, suggesting a focus on European entities, notably within the hotel sector, and referencing Russian attackers through the use of DCRat.

While these attacks predominantly aim at the hospitality sector, everyday users are generally not the target audience. For those at risk, Securonix provides strategic advice to mitigate these threats.