iscover
Share this article on:
Powered by
MOMENTUM
MEDIA
Hackers are harnessing the draw of OnlyFans by using fake “free” content to draw in users and fool them into installing a remote access Trojan (RAT).
OnlyFans, which is a paid service that allows subscribers access to private sexual content from adult creators, as well as exclusive photos and videos from celebrities and online personalities, is widely used, making the promise of free content an attractive prospect for many.
Those who fall for the malware campaign’s trap will find themselves installing a RAT called DcRAT (not to be confused with Dark Crystal RAT), which is a modified version of the AsyncRAT.
The malware is capable of keylogging, engaging remote desktop control, webcam access, file manipulation and monitoring devices through a secure encrypted connection.
The malware campaign was discovered by cyber security organisation eSentire, which has pointed out that the nature of the hack is rather unsophisticated, requiring manual execution and relying on tempting naming conventions.
“In observed instances, victims were lured into downloading Zip files containing a VBScript loader which is executed manually,” said eSentire.
“File naming convention suggest the victims were lured using explicit photos or OnlyFans content for various adult film actresses.”
The report said that it is currently unknown how the Zip files were delivered to victims, but it said that activity had been detected as early as January 2023 and as recently as 4 June 2023. It is not unlikely that hackers posted the content to targeted forums or messaged potential users directly.
eSentire outlines the process that the VBScript loader goes through to inject the malware into a victim’s system.
Threat actors had used OnlyFans as a lure before, after hackers abused an open redirect on the United Kingdom’s Department for Environment, Food and Rural Affairs website to send traffic to fake adult OnlyFans dating websites.
Be the first to hear the latest developments in the cyber industry.
