Cybersecurity researchers are warning about the malware Winos 4.0, which is distributed through game-related applications such as installers and optimization tools.

Winos 4.0 is a powerful malicious platform that has been observed since June, operated by groups under the names Void Arachne and Silver Fox, enabling attackers to control multiple online devices. According to Fortinet FortiGuard Labs, Winos 4.0 is a re-engineered version of an older malware known as Gh0st RAT, featuring various components, each performing distinct functions.

These attacks primarily target Chinese-speaking users, employing tactics such as search engine optimization (SEO), social media, and messaging applications like Telegram to disseminate the malware.

When users install the malicious application, the infection process begins by downloading a fake BMP file from a remote server. This file is subsequently decoded into a DLL library, which downloads additional files from the same server. Among these is a file named “学籍系统” (Student Registration System), indicating that the attacker may be targeting educational institutions.

This malware has the capability to collect system information, copy clipboard content, and gather data from cryptocurrency wallets such as OKX Wallet and MetaMask. Winos 4.0 also allows attackers to download additional plugins from the server to capture screenshots and upload sensitive documents from the compromised system.

Fortinet notes that Winos 4.0 is a robust platform, akin to Cobalt Strike, capable of deep control over compromised systems. The attacks exploit game optimization applications to lure victims into downloading the malware unsuspectingly.

Additionally, the AhnLab Security Intelligence Center (ASEC) has identified another campaign utilizing fake gambling game websites to infect users with WrnRAT malware, which can steal information and provide remote access to attackers. ASEC warns that these attackers may monitor the activities of gambling game users, leading to financial losses.

Researchers advise users to avoid downloading applications from untrustworthy sources and to remain vigilant with game optimization tools to protect personal information and prevent fraud.

Source: The Hacker News