Cheana Stealer Strikes: Windows & macOS VPN Users Under Attack

A phishing campaign impersonates a VPN provider to distribute a stealer named “Cheana Stealer” by targeting Windows, Linux, and macOS users with platform-specific malware. 

The malware steals various data, including cryptocurrency-related information, browser data, login credentials, cookies, and SSH keys, while the attackers leverage a seemingly legitimate website mimicking a known VPN service (“WarpVPN”) and detailed installation guides to trick users into downloading the stealer.  

Telegram channel linked to the campaign, with over 54,000 subscribers, has been active since at least 2018, initially offering legitimate services, such as free VPNs, before transitioning to distributing stealthy malware. 

The phishing site associated with the campaign was added to the channel’s bio in 2021, coinciding with a change in the channel’s operator. 

The channel’s profile photo and posts suggest a Russian origin, but interactions with Arabic speakers and auto-translated posts indicate a potentially different background, and its evolution from legitimate services to malware distribution highlights the potential for trusted entities to be compromised and used for malicious purposes.

TA’s attack on Windows involves PowerShell commands to download a malicious batch file (.bat), which checks for Python and pip, installs them if necessary, and then creates a virtual environment and installs a malicious Python package (hclockify-win). 

This package steals sensitive information, such as cryptocurrency extensions, wallets, and stored browser passwords. It disguises its malicious intent by installing the legitimate Cloudflare application. 

The malicious Python module “hclockify-win” targets various data on Windows to steal cryptocurrency by searching for Chromium-based browsers’ cryptocurrency wallet extensions and Firefox’s MetaMask extension, compressing, and exfiltrating their data. 

It also hunts for installed cryptocurrency wallets and extracts their content. To steal passwords, the module decrypts the “Login Data” file in Chromium browsers and utilizes the “ganache.fflg” module with the NSS library to decrypt credentials in Firefox. 

On Linux, a bash script retrieves browser information, cookies, and SSH keys while mimicking a legitimate Cloudflare Warp installer, while attackers target MacOS users by sending a malicious script called “install.sh” and tricking them into running it. 

The script steals user credentials, cryptocurrency wallets (Bitcoin, Monero, Electrum, Exodus, DashCore, Guarda), and SSH keys and sends them to the attacker’s server using curl POST requests by leveraging legitimate tools like curl and Cloudflare Warp to mask its malicious behavior. 

The stolen data is archived into zip files and exfiltrated over HTTPS port 443 to the attacker’s server, “hxxps://ganache.live/api/v1/attachment.” The attacker uses the Django Rest Framework to manage the stolen data.  

According to CRIL, a phishing campaign masquerading as a VPN provider is targeting users on Windows, Linux, and macOS, where the attackers first lure victims to a phishing website (warpvpn.net) disguised as a legitimate VPN service. 

Once there, users are tricked into downloading malicious scripts (identified by SHA-256 hashes) tailored for their specific operating system and then connecting to a Command and Control server (hxxps://ganache.live) to potentially steal sensitive information.  

Also Read:

D(HE)at Attack: 20-Year-Old Diffie-Hellman Flaw Lets Hackers Overheat Your CPU

See more