Beware! This Microsoft Powerpoint Hack Installs Malware Without Requiring Macros

"Disable macros in addition to ever locomote extra careful when you lot manually enable it spell opening Microsoft Office Word documents."

You powerfulness convey heard of above-mentioned safety alert multiple times on the Internet equally hackers normally leverage this decade onetime macros-based hacking technique to hack computers through specially crafted Microsoft Office files, peculiarly Word, attached to spam emails.

But a novel social applied scientific discipline ready on has been discovered inwards the wild, which doesn't require users to enable macros; instead it executes malware on a targeted organisation using PowerShell commands embedded within a PowerPoint (PPT) file.

Moreover, the malicious PowerShell code hidden within the document triggers equally before long equally the victim moves/hovers a mouse over a link (as shown), which downloads an additional payload on the compromised machine -- fifty-fifty without clicking it.

Researchers at Security theatre SentinelOne convey discovered that a grouping of hackers is using malicious PowerPoint files to distribute 'Zusy,' a banking Trojan, too known equally 'Tinba' (Tiny Banker).

Discovered inwards 2012, Zusy is a banking trojan that targets fiscal websites in addition to has the powerfulness to sniff network traffic in addition to perform Man-in-The-Browser attacks inwards guild to inject additional forms into legit banking sites, bespeak victims to portion to a greater extent than crucial information such equally credit bill of fare numbers, TANs, in addition to authentication tokens.

"A novel variant of a malware called 'Zusy' has been flora inwards the wild spreading equally a PowerPoint file attached to spam emails amongst titles similar 'Purchase Order #130527' in addition to 'Confirmation.' It's interesting because it doesn't require the user to enable macros to execute," researchers at SentinelOne Labs tell inwards a blog post.

The PowerPoint files convey been distributed through spam emails amongst subjects similar "Purchase Order" in addition to "Confirmation," which when opened, displays the text "Loading...Please Wait" equally a hyperlink.

When a user hovers the mouse over the link it automatically tries to trigger the PowerShell code, simply the Protected View safety characteristic that comes enabled past times default inwards nearly supported versions of Office, including Office 2013 in addition to Office 2010, displays a severe alert in addition to prompts them to enable or disable the content.

If the user neglects this alert in addition to allows the content to locomote viewed, the malicious computer programme volition connect to the "cccn.nl" domain name, from where it downloads in addition to executes a file, which is eventually responsible for the delivery of a novel variant of the banking Trojan called Zusy.

"Users powerfulness nonetheless somehow enable external programs because they're lazy, inwards a hurry, or they're exclusively used to blocking macros," SentinelOne Labs says. "Also, around configurations may perchance locomote to a greater extent than permissive inwards executing external programs than they are amongst macros."

Another safety researcher, Ruben Daniel Dodge, too analyzed this novel ready on in addition to confirmed that this newly discovered ready on does non rely on Macros, Javascript or VBA for the execution method.

"This is accomplished past times an chemical constituent Definition for a hover action. This hover activeness is setup to execute a computer programme inwards PowerPoint in 1 lawsuit the user mouses over the text. In the resources Definition of slide1 'rID2' is defined equally a hyperlink where the target is a PowerShell command," Dodge said.

The safety theatre too said that the ready on doesn't function if the malicious file is opened inwards PowerPoint Viewer, which refuses to execute the program. But the technique could nonetheless locomote efficient inwards around cases.

Share This :