May 14, 2019 By Shane Schick 2 min read

Malicious actors are bundling a Trojan that looks like a virtual private network (VPN) tool into adware to install malware on infected machines, security researchers discovered.

Although it masquerades as a legitimate business tool and uses certificates signed by U.K.-based ATX International Ltd., users who download the VPN product or sign up for its three-month trial will have malware executables installed on their machines without their knowledge, according to Bleeping Computer. These include AZORult, which steals passwords. The Trojan also connects to a remote server to drop its malicious payloads.

How Does Pirate Chick Work?

The Trojan’s operators distribute the supposed VPN tool through adware bundles and bogus Adobe Flash Player updates. Once downloaded, process names such as Fiddler, Regshot, ImmunityDebugger, ProcessHacker and Wireshot are combined before checking the victim’s system for any duplication.

It appears the perpetrators are targeting users in specific geographies, since the payload is not executed if the IP address is based in Ukraine, Belarus, Kazakhstan or Russia. Pirate Chick also steers clear of users running certain kinds of virtualization applications, including HyperV, VMware and Virtualbox. If none of those things come up, the researchers explained, the fake VPN software downloads a file that is then saved to a temp folder as an executable.

The cybercriminals behind the phony VPN went to great lengths to make it look like the real thing, including a splash page with a sign-up form for a limited try-before-you-buy offer, no credit card required.

Since its initial discovery, Pirate Chick has stopped infecting victims with AZORult and is now installing Sysinternals Process Monitoring. The researchers said they believe this is a placeholder until the perpetrators add something more sophisticated.

Gain Visibility Into Network Vulnerabilities

Although it’s easy to imagine consumers being fooled into downloading a fake VPN at home, the same thing could also happen to employees at work. According to security experts, IT departments don’t have the visibility they need into potential vulnerabilities that may be happening on the network. To gain this insight, security leaders should consider adopting application scanning technologies that will raise the alarm whenever a threat like Pirate Chick pops up.

More from

Airplane cybersecurity: Past, present, future

4 min read - With most aviation processes now digitized, airlines and the aviation industry as a whole must prioritize cybersecurity. If a cyber criminal launches an attack that affects a system involved in aviation — either an airline’s system or a third-party vendor — the entire process, from safety to passenger comfort, may be impacted.To improve security in the aviation industry, the FAA recently proposed new rules to tighten cybersecurity on airplanes. These rules would “protect the equipment, systems and networks of transport…

Protecting your digital assets from non-human identity attacks

4 min read - Untethered data accessibility and workflow automation are now foundational elements of most digital infrastructures. With the right applications and protocols in place, businesses no longer need to feel restricted by their lack of manpower or technical capabilities — machines are now filling those gaps.The use of non-human identities (NHIs) to power business-critical applications — especially those used in cloud computing environments or when facilitating service-to-service connections — has opened the doors for seamless operational efficiency. Unfortunately, these doors aren’t the…

Communication platforms play a major role in data breach risks

4 min read - Every online activity or task brings at least some level of cybersecurity risk, but some have more risk than others. Kiteworks Sensitive Content Communications Report found that this is especially true when it comes to using communication tools.When it comes to cybersecurity, communicating means more than just talking to another person; it includes any activity where you are transferring data from one point online to another. Companies use a wide range of different types of tools to communicate, including email,…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today