Malware Concealed Within Steam Community Comments
- Malware utilizes Steam Community comments as C2 mechanism
- WordPress installations exploited to inject backdoors
- Close to 2,000 websites have been breached since July
Cybersecurity analysts at GoDaddy have uncovered an intriguing malware campaign that employs comments from Steam Community accounts as a command-and-control (C2) framework.
The attack unfolds as follows: the perpetrators initially identify susceptible WordPress sites—typically those secured with feeble credentials—and use them to conceal PHP malware within the site’s directory.
A notable instance was detected in a theme’s ‘functions.php’ file, housing both a JavaScript injection component and a server-side backdoor.
Upon a visitor’s entry to the compromised website, the malware engages with various Steam Community profiles to retrieve the content of their comments.
At first glance, these comments appear innocuous—albeit somewhat nonsensical—but they discreetly embed invisible Unicode characters that harbor the actual malicious payload.
According to GoDaddy, “This encoding facilitates the embedding of binary data within seemingly ordinary text. The visible characters act as decoys, while the hidden characters transport the genuine payload.”
The malware subsequently extracts these characters, translates them into binary data, and reconstructs the original bytes.
This unscrambled data leads to a URL overseen by the attackers, which directs to a domain harboring a JavaScript file masquerading as a legitimate library.
Furthermore, the malware continues to leverage WordPress to deploy the attacker-led JavaScript on each frontend page, compelling visitors’ browsers to download and execute it, leading to their own infection.
This campaign targets two distinct groups: vulnerable WordPress websites and their unwitting visitors.
Since the discovery of this operation in July of the previous year, GoDaddy’s research indicates that nearly 2,000 WordPress sites have succumbed to a breach.
Regrettably, the research report refrains from elaborating on the specific actions the malware initiates against its victims.
For operators of WordPress websites, GoDaddy suggests a thorough inspection for links to Steam Community URLs, any external JavaScript injections, and unauthorized outbound connections from the WordPress platform to Steam.
Source link: Techradar.com.
