Malicious Interview Software Delivers Info-Stealing Malware

Summary

Threat actors are running job scams that target Web3 professionals by impersonating recruiters and directing candidates to a fraudulent AI meeting platform hosted at relay.lc. The site distributes malicious installers for both macOS and Windows that are designed to steal sensitive information. The malware targets cryptocurrency wallets, browser credentials, Telegram sessions, and macOS Keychain data.

Investigation

SlowMist’s MistEye team analyzed two unpacked samples: a macOS disk image and a Windows executable packaged with NSIS. The investigation found that the macOS version uses shell scripts to remove security attributes and fake AppleScript prompts to capture passwords. The Windows version displays a fraudulent progress bar while silently launching a privileged updater.exe process that scans browser extensions in memory.

Mitigation

Users should avoid downloading software from unverified recruitment links and independently confirm the legitimacy of meeting platforms. Organizations should block identified malicious domains and file hashes at both gateway and EDR levels. macOS users should also treat any instruction to use Terminal commands to bypass quarantine protections as highly suspicious.

Response

If a macOS user executed the malicious script, the device should be disconnected immediately, followed by resets of system, Apple ID, and other high-value credentials. For Windows infections, isolate the endpoint, inspect known registry persistence locations, and assume browser wallet data has been compromised. In both cases, cryptocurrency assets should be moved to newly created wallets from a clean device.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: An adversary has deployed an info-stealer designed to target Chromium-based browsers. To blend in with legitimate browser activity and facilitate the theft of session cookies, the malware attempts to launch a sub-process that mimics a browser extension handler. The attacker executes a renamed version of a browser component, passing the specific command-line argument extension-process to trigger the logic used by the browser’s internal architecture, which the detection rule is specifically looking for.

• Regression Test Script:

  # Simulation of suspicious browser extension process interaction
  # This script creates a dummy executable named 'chrome.exe' to satisfy the Image requirement
  # and executes it with the 'extension-process' flag to satisfy the CommandLine requirement.
  
  $testDir = "$env:TEMPSimulation"
  if (!(Test-Path $testDir)) { New-Item -ItemType Directory -Path $testDir }
  
  $targetExe = "$testDirchrome.exe"
  
  # Create a dummy executable (using PowerShell to simulate a process launch)
  # Note: In a real environment, this would be a malicious binary.
  # For simulation, we use a renamed PowerShell instance to trigger the Sysmon Event ID 1.
  
  # We use a trick to make the 'Image' field look like 'chrome.exe' in logs if possible, 
  # but since we cannot easily rename a running process's Image path without specialized tools,
  # we will simulate the execution of a file named chrome.exe.
  
  New-Item -Path "$testDirchrome.exe" -ItemType File -Force | Out-Null
  
  # Execute the 'malicious' process
  Start-Process -FilePath "$testDirchrome.exe" -ArgumentList "--extension-process --user-data-dir=C:Temp" -WindowStyle Hidden
  
  # Note: Since chrome.exe is a dummy file, Start-Process might fail. 
  # To ensure the rule triggers in a lab, we execute a command that mimics the pattern:
  # We simulate the 'Image' name by using a command that triggers Sysmon to log the string.
  # A more reliable way for this specific Sigma rule is to actually have a file named chrome.exe
  # However, for a quick test, we can use the following:
  
  Write-Host "Executing simulation command..."
  cmd.exe /c "start /b chrome.exe --extension-process" 2>$null
  
  # If the above fails due to file existence, the detection rule won't fire.
  # Manual workaround for the lab: Copy a real chrome.exe to the temp folder.
  $realChrome = "${env:ProgramFiles}GoogleChromeApplicationchrome.exe"
  if (Test-Path $realChrome) {
      Copy-Item $realChrome -Destination $targetExe
      Start-Process -FilePath $targetExe -ArgumentList "--extension-process"
      Write-Host "Simulation command sent successfully."
  } else {
      Write-Error "Real Chrome executable not found. Cannot simulate exact Image path."
  }

• Cleanup Commands:

  Stop-Process -Name "chrome" -ErrorAction SilentlyContinue
  Remove-Item -Path "$env:TEMPSimulation" -Recurse -Force