FlagThis

A sophisticated malware campaign impersonating PDFCandy.com is distributing the ArechClient2 information stealer, according to research from CloudSEK. Cybercriminals are creating fake websites that closely mimic the legitimate PDF conversion tool, tricking users into downloading malware. These deceptive sites are promoted through Google Ads and exploit the common need for online file conversion. By replicating the user interface and using similar domain names, attackers deceive unsuspecting users into believing they are interacting with a trusted service.

The attack unfolds through a series of social engineering tactics. Victims are prompted to upload a PDF file for conversion, after which a simulated loading sequence creates the illusion of genuine file processing. This builds trust and lowers the user’s guard. Subsequently, users are presented with a fake CAPTCHA verification dialog, designed to enhance the site’s perceived authenticity and create a sense of urgency, potentially rushing the user into action. The CAPTCHA acts as a pivotal interaction point to trigger the malicious payload.

After the fake conversion process and CAPTCHA interaction, users are prompted to execute a PowerShell command. This command initiates a sophisticated redirection chain to obscure the malware delivery, ultimately leading to the distribution of the ArechClient2 infostealer. The malware is known for its ability to steal sensitive data, including browser credentials and cryptocurrency wallet information. Cybersecurity experts advise users to rely on verified tools from official websites, keep anti-malware software updated, and implement endpoint detection and response solutions to defend against these advanced threats.

ImgSrc: blogger.googleu

References :

• hackread.com: CloudSEK uncovers a sophisticated malware campaign where attackers impersonate PDFCandy.com to distribute the ArechClient2 information stealer. Learn how…
• securityonline.info: Beware Fake PDF Converters: A Social Engineering Threat
• www.scworld.com: Infostealer deployed via bogus PDFCandy converter
• Cyber Security News: CyberPress: Beware! Online PDF Converters Luring Users into Installing Password-Stealing Malware
• hackread.com: CloudSEK uncovers a sophisticated malware campaign where attackers impersonate PDFCandy.com to distribute the ArechClient2 information stealer
• cybersecuritynews.com: CybersecurityNews: Beware of Online PDF Converters That Tricks Users to Install Password Stealing Malware
• cyberpress.org: Beware! Online PDF Converters Luring Users into Installing Password-Stealing Malware
• gbhackers.com: Beware! Online PDF Converters Tricking Users into Installing Password-Stealing Malware

Classification:

• HashTags: #Malware #PDFCandy #SocialEngineering
• Company: CloudSEK
• Target: Users of online PDF converters
• Attacker: CloudSEK
• Product: PDFCandy
• Feature: Malicious PDF Converters
• Malware: ArechClient2
• Type: Malware
• Severity: High