Security News > 2023 > January > Beware: Tainted VPNs Being Used to Spread EyeSpy Surveillanceware

Tainted VPN installers are being used to deliver a piece of surveillanceware dubbed EyeSpy as part of a malware campaign that started in May 2022.

It uses "Components of SecondEye - a legitimate monitoring application - to spy on users of 20Speed VPN, an Iranian-based VPN service, via trojanized installers," Bitdefender said in an analysis.

The latest attack chain begins when an unsuspecting user downloads a malicious executable from 20Speed VPN's website, indicating two plausible scenarios: Either that the its servers were breached to host the spyware or it's a deliberate attempt to spy on individuals who might download VPN apps to bypass internet blackouts in the country.

Once installed, the legitimate VPN service is launched, while also stealthily kicking off a train of nefarious activities in the background so as to establish persistence and download next-stage payloads for harvesting personal data from the host.

"EyeSpy has the ability to fully compromise online privacy via keylogging and stealing of sensitive information, such as documents, images, crypto wallets, and passwords," Bitdefender researcher Janos Gergo Szeles said.

"This can lead to complete account takeovers, identity theft and financial loss."

News URL

https://thehackernews.com/2023/01/beware-tainted-vpns-being-used-to.html