Nearly a million Windows computers impacted by a malvertising campaign

📟 News

Date: 10/03/2025

According to Microsoft, nearly 1 million Windows devices fell victim to a sophisticated malvertising campaign in recent months. Cybercriminals were able to steal credentials, cryptocurrency, and sensitive information from infected workstations.

Microsoft Threat Intelligence reports that the campaign was launched in December 2024: unknown attackers started distributing links that loaded ads. Microsoft claims that websites hosting such ads were illegal streaming websites offering pirated videos. The company’s report mentions two streaming website domains: movies7[.]net and 0123movie[.]art.

“The streaming websites embedded malvertising redirectors within movie frames to generate pay-per-view or pay-per-click revenue from malvertising platforms,” – Microsoft.

Malvertising redirector URL in the website code
Malvertising redirector URL in the website code

Malicious links contained within an iframe were taking victims through a chain of redirects and a number of intermediate sites (e.g. a scam tech support site) ultimately leading to GitHub repositories containing a variety of malicious files.

Malware was deployed in several stages. At early stages, information on the user’s device was collected, presumably to configure subsequent attack stages. At later stages, malware detectors were disabled, a connection was established with control servers, and the NetSupport remote monitoring and management software was installed.

“Depending on the second-stage payload, either one or multiple executables are dropped onto the compromised device, and sometimes an accompanying encoded PowerShell script. These files initiate a chain of events that conduct command execution, payload delivery, defensive evasion, persistence, C2 communications, and data exfiltration,” – Microsoft.

In addition to GitHub, payloads were also hosted on Discord and Dropbox.

Attack scheme
Attack scheme

Microsoft experts believe that this campaign was opportunistic in nature (i.e. the cybercriminals attacked everyone without distinction and didn’t target specific persons, companies, or industries). As a result, devices belonging to both individuals and various organizations were impacted.

After penetrating into the victim’s system, the malware (mostly the Lumma stealer or an updated version of the Doenerium open-source info stealer) accessed browser data files to steal login cookies, passwords, histories, and other sensitive information:

  • AppDataRoamingMozillaFirefoxProfiles<user profile uid>.default-releasecookies.sqlite;
  • AppDataRoamingMozillaFirefoxProfiles<user profile uid>.default-releaseformhistory.sqlite;
  • AppDataRoamingMozillaFirefoxProfiles<user profile uid>.default-releasekey4.db;
  • AppDataRoamingMozillaFirefoxProfiles<user profile uid>.default-releaselogins.json;
  • AppDataLocalGoogleChromeUser DataDefaultWeb Data;
  • AppDataLocalGoogleChromeUser DataDefaultLogin Data; and 
  • AppDataLocalMicrosoftEdgeUser DataDefaultLogin Data.

The attackers also attempted to access files stored on Microsoft OneDrive and scanned infected systems for cryptocurrency wallets, including Ledger Live, Trezor Suite, KeepKey, BCVault, OneKey, and BitBox.

According to Microsoft, first-stage reports were digitally signed with a newly-created certificate. In total, 12 certificates used in the malvertising campaign were identified and subsequently revoked by the company.

Related posts:
2025.04.01 — Hackers abuse MU plugins to inject malicious payloads to WordPress

According to Sucuri, hackers store malicious code in the MU-plugins (Must-Use Plugins) directory in WordPress and execute it while remaining undetected. The technique was first discovered…

Full article →
2025.04.08 — Website of Everest ransomware group hacked and defaced

Last weekend, the darknet website of the Everest ransomware group was hacked and went offline. The attackers replaced its content with a sarcastic message: "Don't do crime…

Full article →
2025.02.01 — Critical RCE vulnerability fixed in Cacti

A critical vulnerability has been discovered in the open-source Cacti framework: it enables an authenticated attacker to remotely execute arbitrary code. Vulnerability's ID is CVE-2025-22604; its…

Full article →
2025.04.10 — April updates released by Microsoft cause issues with Windows Hello

Microsoft warns that some Windows users who have installed the April updates might be unable to login to their Windows services using Windows Hello facial recognition…

Full article →
2025.02.21 — Microsoft fixes vulnerability in Power Pages exploited by cybercriminals

Microsoft patched a severe privilege escalation vulnerability in Power Pages used by hackers as a 0-day. The vulnerability tracked as CVE-2025-24989 (CVSS score 8.2) pertains…

Full article →
2025.02.20 — Newly-discovered vulnerabilities in OpenSSH open the door to MiTM and DoS attacks

OpenSSH fixed two vulnerabilities that could result in MiTM and denial of service (DoS) attacks. Interestingly, one of these bugs appeared in the code more than 10…

Full article →
2025.04.23 — Improper authentication control vulnerability affects ASUS routers with AiCloud

ASUSTeK Computer Inc. fixed an improper authentication control vulnerability in routers with AiCloud. The bug allows remote attackers to perform unauthorized actions on vulnerable devices. The issue…

Full article →
2025.02.10 — Failed attempt to block phishing link results in massive Cloudflare outage

According to the incident report released by Cloudflare, an attempt to block a phishing URL on the R2 platform accidentally caused a massive outage; as a result, many Cloudflare…

Full article →
2025.03.16 — Researchers force DeepSeek to write malware

According to Tenable, the AI chatbot DeepSeek R1 from China can be used to write malware (e.g. keyloggers and ransomware). DeepSeek was released in January 2025 and caused a stir…

Full article →
2025.01.27 — YouTube plays hour-long ads to users with ad blockers

Users complain that YouTube plays very long unskippable ads. Sometimes such ads are longer than the video the person is watching. The issue was raised…

Full article →