Google-owned malware analysis service VirusTotal has published a report showing how threat actors abuse trust to bypass defenses and deliver their malware.
According to data collected by VirusTotal, legitimate websites and applications are often leveraged for malware delivery.
In some cases, legitimate applications and websites are directly abused. For instance, the company found that 0.1% of legitimate hosts for popular apps have distributed malware. In addition, 10% of the top 1,000 Alexa domains have been observed delivering suspicious files.
The apps themselves are also abused, with 4,000 samples analyzed by VirusTotal executing or packing legitimate application installers. Moreover, 98% of the samples that included legitimate installers in their PE resources were malicious.
“One of the most effective social engineering techniques consists of hiding malware by packaging it into installation packages with legitimate software. This becomes a supply chain attack when attackers get access to the official distribution server, source code, or certificates,” VirusTotal said.
While this technique is not as common as others, the company says it seems to be a ‘constant and slightly growing trend’.
Since 2021, the company has identified more than one million malicious samples that were signed, with 87% of them having a valid signature. Malware signed with stolen keys is likely more common than many expect.
VirusTotal has also reported seeing an increase in attackers mimicking legitimate applications, with Skype, Adobe Acrobat and VLC being the most targeted. When it comes to mimicking legitimate websites, attackers have most commonly targeted WhatsApp, Instagram and Amazon.
“When thinking about these techniques as a whole, one could conclude that there are both opportunistic factors for the attackers to abuse (like stolen certificates) in the short and mid term, and routinely (most likely) automated procedures where attackers aim to visually replicate applications in different ways,” VirusTotal noted.
It added, “Although less sophisticated, the aggregate effect of these techniques could lead to a bigger combined impact than more complex but less voluminous attacks. That’s why it seems there are good candidates to monitor at a global level how malware attackers abuse them, which can also help automatically detect suspicious samples before they hit the victim.”
Related: VirusTotal Shares Analysis of 80 Million Ransomware Samples
Related: VirusTotal Hacking Offers a Supercharged Version of Google Hacking
Related: VirusTotal Introduces ‘Collections’ to Simplify IoC Sharing
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- New Russia-Linked CosmicEnergy ICS Malware Could Disrupt Electric Grids
- Drop in Insider Breaches Drives Decline in Intrusions at OT Organizations
- Zero-Day Vulnerability Exploited to Hack Barracuda Email Security Gateway Appliances
- OAuth Vulnerabilities in Widely Used Expo Framework Allowed Account Takeovers
- New Honeywell OT Cybersecurity Solution Helps Identify Vulnerabilities, Threats
- Rheinmetall Says Military Business Not Impacted by Ransomware Attack
- Dish Ransomware Attack Impacted Nearly 300,000 People
- Samsung Smartphone Users Warned of Actively Exploited Vulnerability
Latest News
- Memcyco Raises $10 Million in Seed Funding to Prevent Website Impersonation
- New Russia-Linked CosmicEnergy ICS Malware Could Disrupt Electric Grids
- Security Pros: Before You Do Anything, Understand Your Threat Landscape
- Major Massachusetts Health Insurer Hit by Ransomware Attack, Member Data May Be Compromised
- Apria Healthcare Notifying 2 Million People of Years-Old Data Breaches
- European Cybersecurity Firm Sekoia.io Raises $37.5 Million
- Today’s Cyber Defense Challenges: Complexity and a False Sense of Security
- Drop in Insider Breaches Drives Decline in Intrusions at OT Organizations

