Visa issues alert on the rising threat from JSOutProx malware targeting financial institutions

Visa has recently issued a critical security alert concerning a significant uptick in the activity of the particularly hazardous JSOutProx malware. This remote access trojan (RAT) is known for its sophisticated attack capabilities on financial institutions and their customers, particularly targeting regions in South and Southeast Asia, the Middle East, and Africa.

Origins and Evolution of JSOutProx Malware

First identified in December 2019, JSOutProx is a highly obfuscated JavaScript backdoor that enables cybercriminals to execute a myriad of malicious activities. These include running shell commands, downloading additional harmful payloads, executing files, capturing screenshots, and gaining complete control over the infected device’s keyboard and mouse.

Over time, JSOutProx has evolved, enhancing its evasion techniques to avoid detection and increasing its destructive capabilities.

The March 2024 Phishing Campaign

On March 27, 2024, Visa’s Payment Fraud Disruption (PFD) unit detected a new phishing campaign distributing this advanced malware. The campaign employs a method where financial notifications, seemingly from legitimate institutions, are sent to targets. These communications often masquerade as notifications from SWIFT or MoneyGram and contain malicious attachments. Once opened, these .js files within ZIP archives initiate the download of the JSOutProx payload from a GitLab repository, setting the stage for the malware to take control.

Capabilities of JSOutProx

The initial payload of JSOutProx supports basic yet critical functionalities that allow attackers considerable control over the compromised systems. These capabilities include updating the malware, managing its operational timelines to avoid detection, executing processes, and even terminating the implant when necessary.

However, it is in the second stage of the infection where JSOutProx reveals its full malicious potential. Additional plugins introduced at this stage allow for:

• Dormant operations to avoid detection.
• Manipulation of internet traffic through altered proxy settings.
• Theft of sensitive data such as passwords from clipboard content.
• Redirection of traffic via adjusted DNS settings, aiding in stealthy command and control (C2) communications or further phishing attacks.
• Detailed extraction of contact information from applications like Outlook for broader phishing or malware spread.
• System registry modifications to bypass User Account Control (UAC) and maintain persistence.
• Theft of One-Time Passwords (OTPs), crucial for bypassing two-factor authentication.

Mitigation and Recommendations

In response to the rising threat from JSOutProx, Visa’s alert included several recommendations for mitigation. These include raising awareness about the risks of phishing, enabling EMV and other secure acceptance technologies, securing remote access points, and vigilant monitoring for suspicious transactions. Each of these steps forms a critical component of a robust defensive strategy against such advanced malware threats.

The Bigger Picture

The sophistication and targeted nature of the JSOutProx phishing operations suggest the involvement of highly organized cybercriminal groups. Early iterations of the malware were linked to an entity known as ‘Solar Spider,’ though attribution for the latest spikes in activity remains uncertain. Analysts suggest, with moderate confidence, that the operations may be conducted by Chinese or China-affiliated threat actors, given the malware’s complexity and geographic focus of the attacks.

A Call to Action for Enhanced Cybersecurity Vigilance

The continued evolution and deployment of JSOutProx underscore an urgent need for financial institutions worldwide to bolster their cybersecurity measures. It’s evident that cybercriminals are continually refining their strategies and tools to exploit any vulnerability. In response, organizations must not only stay vigilant but also proactively update and fortify their cybersecurity protocols.

Financial institutions must consider integrating advanced security platforms that can offer real-time application visibility, monitoring, and automatic responses to suspected malicious activities. These systems should provide comprehensive visibility into application behaviors, anomaly detection, and the ability to isolate threats quickly. Furthermore, institutions should regularly train employees on the latest cybersecurity practices to recognize the signs of phishing and encourage a culture of security awareness throughout the organization.

Organizations need robust protection against the likes of infostealer malware by employing a comprehensive suite of security measures designed to safeguard enterprise environments. By leveraging behavioral analytics to monitor and analyze normal application behaviors, it is possible to quickly identify and alert on any anomalies or deviations that could indicate a malware infection. Advanced machine learning algorithms can detect even the most sophisticated threats in real-time. Additionally, granular policy enforcement and segmentation controls (leveraging microsegmentation tools) to isolate and contain potential threats, preventing the spread of malware within the network. By continuously assessing and managing the security posture of its protected environments, it is possible to ensure that organizations can not only detect but also respond to malware threats effectively, minimizing potential damage and maintaining operational continuity.

As digital threats grow more dangerous, the financial sector must prioritize adaptive, multi-layered security strategies to protect against sophisticated malware like JSOutProx. The security of financial transactions and customer data depends on it, making continuous improvement and vigilance in cybersecurity practices imperative.

The post JSOutProx Malware Variant Targeting Financial Orgs., Warns Visa appeared first on TrueFort.

*** This is a Security Bloggers Network syndicated blog from TrueFort authored by Nik Hewitt. Read the original post at: https://truefort.com/jsoutprox-malware/