July 1, 2021 By David Bisson 2 min read

Living-off-the-land attacks aren’t new. They’re tactics in which attackers misuse tools native to an infected device. They do this in an effort to not install any foreign files or tools as a means. That way, most security tech won’t notice something odd going on. We’ve taken a look at one of these, misuse of AutoHotkey, and how to prevent it.

Several attackers involving living-off-the-land methods have made headlines in recent years. For example, a threat actor known as Gallmaker used the Microsoft Office Dynamic Data Exchange protocol back in 2018 to spy on its victims. A year later, attackers misused the Windows Management Instrumentation Command tool to distribute Astaroth.

What Is AutoHotkey?

What is new is attackers’ decision to misuse AutoHotkey. This is a Microsoft product, an open-source scripting language designed for machines running Microsoft Windows. AutoHotkey scripts can automate repetitive tasks in a Windows app by creating macros, shortcuts or hotkeys.

How Are Malware Actors Using AutoHotkey Scripts?

One of the first publicly reported attacks involving AutoHotkey was a credential stealer written in AutoHotkey found in March 2018. It disguised itself as Kaspersky Antivirus and spread via infected USB devices. The threat, dubbed Fauxpersky, dropped four files into the affected environment. Together, those files launched a keylogger. This sent the stolen user input to the attackers and then distributed the threat to other removable media.

Fast forward to December 2020, when Trend Micro discovered a malicious Excel file concealing an AutoHotkey script compiler executable, a malicious AutoHotkey script file and a VBA AutoOpen macro. The operation used the script file to profile victims and perform different tasks. Those included harvesting credentials from a victim’s browser and sending them to the attackers.

A few months later, Cofense came across two phishing emails targeting Spanish users. One of the emails instructed the recipient to download a file protected by a password. Meanwhile, the other prompted recipients with the lure of pending legal documents. These payloads used either the Microsoft Service Identity service or a malicious Finger command to create a second .zip file. This archive contained three items: a real AutoHotkey compiler executable, a malicious AutoHotkey script and the Mekotio banking Trojan as a .dll. Once loaded, Mekotio attempted to load fake webpages for targeted banks. It also watched for bitcoin addresses that were copied to the clipboard.

Which brings us to a recent attack: in mid-May 2021, a remote access Trojan delivery campaign began with an AutoHotkey-compiled script. This script loaded an executable that, when it ran, branched into one of four versions. These involved different VBScripts and malware payloads including VjW0rm, Houdini and HCrypt.

How to Defend Against These New Attacks

The campaigns above highlight the need for employers to defend themselves against attacks via AutoHotkey scripts. One of the ways they can do that is by restricting phishing emails and other attacks that could deliver malicious AutoHotkey compiler executables. They can do this by investing in a security awareness training program that uses phishing tests to make employees familiar with email-based attacks. You can balance these human controls with technical measures, as well. Think email banners that signal when a message has come from outside of the group.

Beyond awareness training, you can also take steps to defend against fileless attacks. This involves carefully reviewing the native apps and tools that your employees need for their normal work. With that knowledge, security personnel can then disable whichever are not needed.

More from News

White House cements CISA’s role as national coordinator for cybersecurity

2 min read - In 2013, the Obama Administration rolled out "The Presidential Policy Directive (PPD) on Critical Infrastructure Security and Resilience", a forerunner to the Cybersecurity and Infrastructure Security Agency (CISA), created "to strengthen and maintain secure, functioning and resilient critical infrastructure."The directive was groundbreaking in 2013, noting the importance of the rising risk of cyberattacks against critical infrastructure. But as cyber risks are constantly shifting, every cybersecurity program needs to be re-evaluated, and CISA is no exception. That’s why, in April 2024, President…

Debate rages over DMCA Section 1201 exemption for generative AI

3 min read - The Digital Millennium Copyright Act (DMCA) is a federal law that protects copyright holders from online theft. The DMCA covers music, movies, text and anything else under copyright. The DMCA also makes it illegal to hack technologies that copyright owners use to protect their works against infringement. These technologies can include encryption, password protection or other measures. These provisions are commonly referred to as the “Anti-Circumvention” provisions or “Section 1201”. Now, a fierce debate is brewing over whether to allow…

CISA Malware Next-Gen Analysis now available to public sector

2 min read - One of the main goals of the Cybersecurity and Infrastructure Security Agency (CISA) is to promote security collaboration across the public and private sectors. CISA firmly believes that partnerships and effective coordination are essential to maintaining critical infrastructure security and cyber resilience. In faithfulness to this mission, CISA is now offering the Malware Next-Generation Analysis program to businesses and other organizations. This service has been available to government and military workers since November 2023 but is now available to the…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today