Attackers embed malware in web images to evade detection
According to an HP security report, attackers are embedding malware in images on legitimate websites and using generative AI to create attack tools, reducing the skill and time needed for cyberattacks. Multiple campaigns distributing keyloggers, password-stealing malware and other tools have been detected targeting endpoints.
What happened
According to an HP Threat Insights report analyzing third-quarter 2024 data from millions of endpoints, attackers have embedded malicious code in images hosted on legitimate websites like archive.org to distribute malware including VIP Keylogger and 0bj3ctivityStealer.
Attackers used generative AI to create malicious HTML documents in XWorm RAT campaigns, and compromised video game cheating tools on GitHub by adding executable files containing Lumma Stealer malware that steals passwords, cryptocurrency wallets and browser information.
Reported impact
The report indicates that malware-by-numbers kits and generative AI reduce the time and skill level required for attackers to plan and execute attacks.
Image-based infection techniques help attackers bypass detection because image files appear benign when downloaded from well-known websites. Users who disable security tools to download gaming cheating tools face increased infection risk.
Index analysis
HP researchers identified multiple distinct malware campaigns exploiting similar embedding techniques in images across well-known platforms.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.