A phishing campaign impersonating Bank of America (BoA) is underway, trying to trick Windows users into installing ScreenConnect remote access software and then making it difficult to uninstall it.
Different traps for Mac and Windows users
By claiming the recipient must take specific actions “to avoid account restrictions,” the email, sent from onlinebanking@ealerts[.]bkofamerica[.]com, tries to push them to follow the link without thinking.
According to Huntress researchers, Mac users are taken to a BoA lookalike page that asks them to log in with their username and password, and then to enter personal and financial information.
Windows users land on another BoA lookalike page, which tells them to update their information and download and install software called “Account Guard”:
The “Update My Information” button triggers the downloading of
AccountGuardSetup.zip.
Users who unzip the archive file and run the AccountGuardSetup.vbs file inside it will trigger a chain resulting in a custom ScreenConnect remote monitoring and management (RMM) client getting installed and run, allowing the threat actor to connect to the compromised computer.
“The IP address geolocates to the United Arab Emirates and is reputationally challenged, given that several other malware families appear to use this address as a command-and-control (C2),” Huntress cybercrime analyst Andrew Brandt shared.
Installing ScreenConnect and hiding it
Analysis of the VBS file was made difficult (but not impossible) by “an unusual amount of embedded, base64-encoded data blobs inside every script that runs a stage of the attack.”
Huntress’ analysis revealed what happens when these blobs are decoded:
- After a delay, several PowerShell scripts are run in succession, one calling upon the other
- The final one downloads and decodes an encoded sc.msi file from UploadToURL.com and writes in the %localappdata%Microsoft folder, then decripts two additional data blobs embedded within itself
The first blob contains a public User Account Control bypass exploit that the final PS script uses to install the ScreenConnect sc.msi file with Administrator privileges (and without triggering a user prompt).
ScreenConnect registers as a Windows service, with a name that’s meant to blend in: “Windows Security”.
“The second AES-encrypted blob decrypts into a VBScript that does two things: It deletes the Registry key that points at the ScreenConnect installer, and prevents ScreenConnect from showing up in the list of installed apps (or from being uninstalled normally),” Brandt noted.
“The script then uses the Windows Service Descriptor Definition Language (SDDL) and Access Control Lists (ACLs) to block targets from making changes to their computer and hide the ScreenConnect process.”
Finally, the parent PS script deletes both scripts.
Cleanup is the hard part
If you known where to look – i.e., your browser’s address bar – and you don’t let your guard down because you’re panicking about losing access to your bank account, the phishing pages are easily identifiable: they are hosted on domains (kleinschnitg[.]com, sectioncompil[.]com) that look nothing thing like the legitimate BoA domain.
Those unfortunate enough to have fallen for the lure will have a hard time uninstalling the ScreenConnect client, due to SDDL ACLs blocking the user from making changes to the computer and concealing the ScreenConnect process.
Common tools like services.msc, Get-Service, and sc.exe query will not list the “Windows Security” service, Brandt noted.
“Based on the initial phishing email, this appears to be a generic brand impersonation of Bank of America, meaning that it has likely been sent to a big population of potential victims, rather than customized for specific targets. We also received the initial phishing email via our honeytrap account, which also tells us the attacker was likely blasting emails broadly,” the company told us.
The attack also appears to be set up in a way to maximize the attackers’ yield across a mass audience with different devices.
“While the attackers likely built the attack around a Windows machine (i.e., the use of SDDL), if someone visits from another OS they can still phish them, so this expands their reach,” they concluded.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
