Threat actors have been discovered distributing ChromeLoader malware via files masquerading as cracks or mods for Nintendo and Steam games.
According to a security researcher at secondsLike , the malicious activity the team recently observed relied on VHD disk image files.
“When a VHD file is downloaded in this process, a user could easily mistake a malicious VHD file for a game-related program,” reads an advisory the company issued Thursday.
The list of filenames used to distribute the malware included several popular games such as Elden Ring, Red Dead Redemption 2 and Dark Souls 3.
Some of the observed files masqueraded as common software programs such as Microsoft Office and Adobe Photoshop.
“Everything but the Install.lnk file has the hidden property enabled, so normal users only see the Install.lnk file,” Asec wrote.
When the victim clicks on that file, it initiates a series of steps and eventually downloads ChromeLoader. The adware then uses her Chrome extension to perform malicious actions.
“A malicious extension created and executed by ChromeLoader redirects to advertising websites and collects user browsing data through hijacking.” Asek post. “It is capable of a variety of functions, such as collecting browser credentials and modifying browser settings.”
According to technical articles, the ChromeLoader attack marks an increase in malware using disk image files.
“Disguising malware as a game hacking or cracking program is a tactic employed by many attackers,” the Asec team wrote.
“Since last year, there has been a steady increase in the use of disk image files such as ISOs and VHDs to distribute malware.”
Therefore, the advisory warns users to be careful when running files downloaded from unknown sources.
“Users are advised to download the program from the official website,” Asec concluded.
The research document states that ChromeLoader is Ransomware technology analysis By Tim Wallen, Logpoint’s UKI & BeNeLux Regional Director.
