Hackers are now targeting Windows driver flaw for malware

As if there weren’t enough threats to your Windows computer already, here is another one to be careful with. Kaspersky reports that tens of thousands of compromised PCs are infected as cybercriminals advertise fake activators and cracks to lure in unsuspecting users for distinct software such as AutoCAD, JetBrains, and Foxit PDF Editor.

The malicious package named SteelFox has been quietly spreading since February 2023, but its distribution has exploded recently. The malware is dispersed using torrent trackers and forums, where it is used as a tool to activate authentic versions of the previously mentioned software.

The experts at Kaspersky warn that the malware mimics cryptocurrencies and steals sensitive financial and non-financial information from your devices. When you install the fake crack, a vulnerable driver called WinRingO.sys is added that restores CVE-2021-41285 and CVE-2020-14979, four- and three-year-old vulnerabilities that give hackers full access to your PC.

When hackers access these vulnerabilities, they insert XMRig, a program that steals computer resources to mine cryptocurrency, an attack known as cryptojacking. XMRig uses your electricity, PC power, and the internet to mine Monero and other cryptocurrencies, making your PC useless. An info stealer is also inserted to retrieve data from 13 web browsers, including browsing history, credit card info, session cookies, network data, and system information. A Remote Desktop Protocol (RDP) connection is also established.

The report also mentioned a malicious post that included complete instructions on how to launch the software illegally. Further, Kaspersky says that “the execution chain looks legitimate until the moment the files are unpacked.” The damaging software is inserted in the process and adds the machine code that launches Steelfox.

Kaspersky also says it has blocked 11,000 attacks thus far, but the number can easily be much higher. Affected users are worldwide, including in…