Full Report
A story about operators of JS-sniffer FakeSecurity distributing Raccoon stealer
Analysis Summary
# Tool/Technique: FakeSecurity JS-Sniffer & Raccoon Stealer Distribution
## Overview
This campaign involves the operators of the **FakeSecurity JS-sniffer** leveraging their access to compromised e-commerce websites to distribute **Raccoon Stealer** (and other information stealers like Vidar). While JS-sniffers are traditionally used to steal credit card data directly from checkout pages, this specific activity shows a shift toward using the same infrastructure to deploy secondary malware via social engineering (fake updates).
## Technical Details
- **Type:** Malware Family (JS-sniffer / Infostealer)
- **Platform:** Web Browsers (JS-sniffer), Windows (Raccoon/Vidar Stealer)
- **Capabilities:** Credit card data exfiltration, credential theft, system information harvesting, cryptocurrency wallet theft.
- **First Seen:** FakeSecurity has been active since at least 2018; Raccoon Stealer distribution through this method was highlighted in recent Group-IB reporting.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1189 - Drive-by Compromise]
- **[TA0002 - Execution]**
- [T1204.001 - User Execution: Malicious Link]
- **[TA0006 - Credential Access]**
- [T1555 - Credentials from Password Stores]
- [T1601 - Steal Web Session Cookie]
- **[TA0010 - Exfiltration]**
- [T1041 - Exfiltration Over C2 Channel]
## Functionality
### Core Capabilities
- **Web Skimming:** Injects malicious JavaScript into e-commerce checkout pages to intercept and exfiltrate payment card data (PAN, CVV, Expiry).
- **Social Engineering (Drive-by):** Displays fake browser or software update notifications (e.g., "Adobe Update" or "Chrome Update") to lure visitors into downloading a malicious executable.
- **Information Theft:** Once Raccoon Stealer is executed, it harvests passwords, cookies, autofill data, and crypto wallets.
### Advanced Features
- **Domain Squatting/Masquerading:** Uses domains that mimic legitimate services (e.g., `cloud-server-updater`, `microsoft-cloud`, `azure-cloud`) to host malicious payloads and C2 scripts.
- **Multi-Stage Loading:** Uses JS-sniffers as a beachhead to identify high-value targets before deploying more intrusive stealers.
## Indicators of Compromise
### File Names
- `update_chrome.exe`
- `adobe_update.exe`
- `FlashPlayer.exe`
### Network Indicators (Defanged)
- **JS-Sniffer C2/Hosting:**
- `cloud-js[.]co.za`
- `magento-security[.]co.za`
- `node-js[.]co.za`
- `payment-js[.]co.za`
- **Stealer Distribution/C2:**
- `cloud-server-updater20[.]co.za` through `cloud-server-updater28[.]co.za`
- `oneupdateadobe[.]co.za`
- `microsoft-cloud10[.]co.za`
- `azure-cloud1[.]co.za`
- `35.228.95[.]80`
- `34.105.255[.]170`
## Associated Threat Actors
- **FakeSecurity Operators:** A specific group focused on Magento and other e-commerce platform compromises.
- **Raccoon Stealer Affiliates:** Likely acting as customers or partners of the Raccoon Malware-as-a-Service (MaaS).
## Detection Methods
- **Signature-based:** Detection of known Raccoon Stealer PE (Portable Executable) headers and JS-sniffer script patterns.
- **Behavioral detection:** Monitoring for unexpected `POST` requests to suspicious `.co.za` or `.org.za` domains originating from browser processes.
- **YARA Rules:** Target JS patterns that hook into `input` fields on payment pages and specific Raccoon Stealer strings in memory.
## Mitigation Strategies
- **For Website Owners:** Implement Content Security Policy (CSP) to restrict where scripts can be loaded from and where data can be sent. Conduct regular integrity checks on web server files.
- **For End Users:** Disable JavaScript on untrusted sites and treat "Required Update" pop-ups on third-party websites as malicious. Use EDR solutions to block unauthorized execution of downloaded binaries.
## Related Tools/Techniques
- **Magecart:** The broader umbrella of web-skimming activities.
- **Vidar Stealer:** Another infostealer observed being distributed by the same infrastructure.
- **Mephistophilus:** A related loader/distribution framework mentioned in associated tracking.