(Photo Illustration by Thomas Fuller/SOPA Images/LightRocket via Getty Images)
A hacker is using interest in free antivirus software to spread a nasty malware infection to Windows PCs, according to security researchers.
The malware is circulating through a fake Bitdefender website at bitdefender-download[.]co, which makes the domain appear legit. But in reality, the site will install three pieces of malware, warns the security provider DomainTools.
(Credit: PCMag)The fake site seems to spoof all the elements found on the official site for Bitdefender's free antivirus program for Windows. However, the download link on the malicious site will deliver a ZIP archive that contains the malicious attack, which includes the so-called "VenomRAT," a remote access Trojan that can secretly harvest passwords and record keystrokes.
(Credit: DomainTools)In addition, the attack will install the StormKitty and SilentTrinity malware programs, which can also steal passwords, including details for cryptocurrency wallets, and maintain long-term access to the PC. “The implications of long-term access may include repeat compromise or selling access,” DomainTools added.
The security provider suspects the fake Bitdefender site was likely used in phishing attacks since the malicious domain overlapped with internet infrastructure hosting other fake sites impersonating banks and IT services.
A security researcher on X/Twitter initially spotted the fake Bitdefender last week. In response, the antivirus company said: “This website is not operated by Bitdefender or our partners, and we are working to have it taken offline. We do detect the file that it serves and also block access to the website.”
Although the fake Bitdefender site remains up, Google’s Chrome browser will flag the link to the free software as malicious, preventing users from downloading it.