Security company Proofpoint has discovered malicious software that automatically photographs users through their webcams when they visit pornographic sites. The images are then used for extortion purposes.
The new spyware Stealerium has a particularly disturbing function: it monitors the victim’s browser for pornography-related search terms like “sex” and “porn”, while simultaneously taking screenshots and webcam photos of the user, sending everything to the hacker.
Security company Proofpoint discovered the software in tens of thousands of email messages sent since May this year. Victims were tricked into downloading the program through fake invoices and payment demands, primarily targeting companies in hospitality, education and finance.
— When it comes to infostealers, they typically are looking for whatever they can grab, says Selena Larson, researcher at Proofpoint to Wired.
— This adds another layer of privacy invasion and sensitive information that you definitely wouldn’t want in the hands of a particular hacker. It’s gross. I hate it, she adds.
Available openly on Github
In addition to the automated sextortion function, Stealerium also steals traditional data such as banking information, passwords and cryptocurrency wallet keys. All information is sent to the hacker via services like Telegram, Discord or email.
Strangely, Stealerium is distributed as free open source code on Github. The developer, who calls himself witchfindertr and claims to be a “malware analyst” in London, maintains that the program is “for educational purposes only”.
— How you use this program is your responsibility. I will not be held accountable for any illegal activities. Nor do i give a shit how u use it, the developer writes on the page.
Kyle Cucci, also a researcher at Proofpoint, calls automated webcam images of users browsing porn “pretty much unheard of”. The only similar case was an attack against French-speaking users in 2019.
New trend among cybercriminals
According to Larson, the new type of attacks may be part of a larger trend where smaller hacker groups are turning away from large-scale ransomware attacks that attract authorities’ attention.
— For a hacker, it’s not like you’re taking down a multimillion-dollar company that is going to make waves and have a lot of follow-on impacts. They’re trying to monetize people one at a time. And maybe people who might be ashamed about reporting something like this, Larson explains.
Proofpoint has not identified specific victims of the sextortion function, but believes that the function’s existence suggests it has likely already been used.
