Ankura CTIX FLASH Update - January 7, 2025

Malware Activity

PLAYFULGHOST Malware Spread via SEO Poisoning and Phishing

Cybersecurity researchers have identified multiple campaigns relating to a new malware dubbed "PLAYFULGHOST". PLAYFULGHOST's capabilities overlap with the Gh0st RAT remote access tool, designed to act as backdoor and to steal sensitive information. Attackers either use phishing emails or SEO poisoning to coax victims into downloading a trojanized version of a legitimate VPN application like LetsVPN. The delivery of PLAYFULGHOST can be sophisticated, as researchers noted an execution scenario in which a Windows shortcut combines the contents of two other files to construct a rogue DLL required to load the final payload. PLAYFULGHOST establishes persistence in victim environments via the Run registry key, scheduled task, Windows Startup folder, and Windows service. The malware can gather and exfiltrate data including keystrokes, screenshots, audio, QQ account information, and clipboard