Facebook Ads Manager becomes a victim of Trojan information theft

An unknown hacker group is distributing a Trojan stealing information disguised as a PDF reader that can copy Facebook session cookies

Facebook Ads Manager becomes a victim of Trojan information theft

An unknown hacker group is distributing a Trojan stealing information disguised as a PDF reader that can copy Facebook session cookies as well as sensitive data from the Facebook Ads Manager. .

In particular, on November 30, MalwareHunterTeam found many websites distributing fake PDF editing program called 'PDFreader'. Executables distributed from this site are signed by a digital certificate issued by Sectigo for "Rakete Contenticineh".

Facebook Ads Manager becomes a victim of Trojan information theft Picture 1

VirusTotal then took over and identified this Trojan as Socelars, however it possessed some similarities with other Trojans, such as AdKoob and Stresspaint, in attempting to extract and steal Facebook data from Many different URLs. However, according to Vitali Kremez, the security expert who is responsible for analyzing this Trojan, there is not much similarity in code between this Socelars and other Trojans, so it can be confirmed that this is a specially developed Trojan. instead of upgrading from known Trojans.

Facebook Ads Manager becomes a victim of Trojan information theft Picture 2

Target Facebook Ads Manager

First, Socelars will attempt to steal Facebook cookie sessions from Chrome and Firefox by accessing the SQLite Cookies database. After the cookie is successfully retrieved, it will be used to connect various Facebook URLs where the information is extracted.

 https://www.facebook.com/bookmarks/pages?ref_type=logout_gear 

 https://secure.facebook.com/settings 

 https://secure.facebook.com/ads/manager/account_settings/account_billing/

The account_billing URL will be used to extract the user's account and access_token, which will then be used in the Facebook Graph API call to steal data from the user's Ads Manager settings.

Facebook Ads Manager becomes a victim of Trojan information theft Picture 3

The call to the Facebook Graph API is as follows:

 https://graph.facebook.com/v4.0/act_{account_id}?_reqName=adaccount&_reqSrc=AdsPaymentMethodsDataLoader&fields=%5B%22all_payment_methods%7Bpayment_method_altpays%7Baccount_id%2Ccountry%2Cc 7D% 2Cpm_credit_card% 7Baccount_id% 2Ccredential_id% 2Ccredit_card_address% 2Ccredit_card_type% 2Cdisplay_string% 2Cexp_month% 2Cexp_year% 2Cfirst_name% 2Cis_verified% 2Clast_name% 2Cmiddle_name% 2Ctime_created% 2Cneed_3ds_authorization% 2Callow_manual_3ds_authorization% 2Csupports_recurring_in_india% 7D% 2Cpayment_method_direct_debits% 7Baccount_id% 2Caddress% 2Ccan_verify% 2Ccredential_id% 2Cdisplay_string% 2Cfirst_name% 2Cis_awaiting% 2Cis_pending% 2Clast_name% 2Cmiddle_name% 2Cstatus% 2Ctime_created% 7D% 2Cpayment_method_extended_credits% 7Baccount_id% 2Cbalance% 2Ccredential_id% 2Cmax_balance% 2Ctype% 2Cpartitioned_from% 2Csequential_liability_amount% 7D% 2Cpayment_method_paypal% 7Baccount_id% 2Ccredential_id% 2Cemail_address% 2Ctime_created% 7D % 2Cpayment_method_stored_balances% 7Baccount_id% 2Cbalance% 2Ccredential_id% 2Ctotal_fundings% 7D% 2Cpayment_method_tokens% 7Baccount_id% 2Ccredential_id% 2Ccurrent_balance% 2Coriginal_balance% 2Ctime_created% 2Ctime_expire% 2Ctype% 7D% 7D% 22% 5D & include_headers = false & locale = it_IT & method = get & pretty = 0 & suppress_http_code = 1

Data that can be stolen includes session cookies, access tokens, account ids, promotional email addresses, related pages, credit card information (numbers, expiration dates), PayPal emails, balances. advertisements, spending limits, etc., are then compiled and sent to the attacker's Command & Control (C2) server.

More seriously, attackers can use these stolen Facebook cookies to access their accounts and use them to create their own malicious advertising campaigns.

This Trojan is silently executed and performs all its actions in the background, so users will not know that they have become victims of malicious code. Facebook has not yet commented on the incident.

The Trojan said the sentence ... 'Farewell' to the victim
a newly discovered trojan program not only disturbs data inside a victim's computer, but it also smiles at the pain of users.
Ransomware STOP started installing Trojans to steal victim passwords
in addition to encrypting files on the system, ransomware stop strains have also started quietly installing the azorult password stealing trojan on the victim's computer to steal account information, electronic wallet, and file desktop ...
Microsoft warned the Emotet trojan back on a large scale, stealing the victim's banking information
after 5 months of silence, from february 2020 until now, the emotet trojan has just officially returned with a larger scale.
Azorult Trojan steals user passwords while running in the background like Google Update
azorult trojan is a malware released to steal user information on a large scale.
Trojans steal 100,000 personally identifiable information
security experts are warning a kind of data theft trojan through online advertising on job sites. most recently, the prg trojan has taken over 100,000 personally identifiable information.
The 4 true stories show how scary identity theft can be
in fact, being a victim of identity theft can be more frightening than many people imagine, you may even lose your identity or commit murder ...
New variant Gozi Trojan raged again
since april 17, there have been more than 2,000 home users falling victim to the latest variant of gozi data theft trojan. the new gozi variant has been rated extremely dangerous with new upgrades and equipped with the ability to hide itself more highly in the face of.
Trojan-Downloader_Win32_Agent.nmi
the trojan downloads another program through the internet and launches it on the victim's computer without the user's knowledge or permission.
Malware uses sex images to distract users
a consultant of it security firm sophos warned: don't become a victim of malware using powerpoint files containing 'room' images from the kama sutra.
Risks from malware and how to prevent it
the article will focus on recent malware threats and suggest possible solutions to deal with these threats.
Malware spreads through crack software specializing in stealing Facebook, Instagram, and Twitter accounts
security researchers have discovered an information-stealing malware called ffdroider. by stealing credentials and cookies stored in the browser, ffdroider can take control of the victim's social media accounts.
Be wary of phishing when logging on to Facebook and how to protect your Facebook account
those who do not pay attention will easily be the victim hacked or cheated, if you regularly use facebook, then you should start paying attention is just if you do not want to be a victim.