BazarLoader malware abuses Windows 10 apps in 'Call Me Back' attack

The highly targeted phishing campaign abuses appxbundle to infect devices

A new phishing campaign is abusing an app feature in Windows 10 to spread the BazarLoader malware.

The campaign’s discovery came when employees started receiving the malware-laden emails, according to security researchers at Sophos.

One email appeared to be sent by a "Sophos Main Manager Assistant” called "Adam Williams.” In the email, the person demanded to know why the recipient hadn't responded to a customer's complaint, which appeared as a PDF link in the email.

However, if a victim clicked on the link, it downloaded and installed the BazarLoader malware. Researchers said this malware was delivered by abusing a novel mechanism, the Windows 10 apps installer process.

The researchers said the phishing campaign sends victims to a website sporting the Adobe logo to look more legitimate. The text on the page asks victims to click on a link to preview the alleged PDF.

“But there’s something amiss with this link: Instead of being prefixed with the expected https:// the link instead begins with what was (for me, at least) an unfamiliar ms-appinstaller: prefix,” said SophosLabs Principal Researcher Andrew Brandt.

"In the course of running through an actual infection I realized that this construction of a URL triggers the browser [in my case, Microsoft's Edge browser on Windows 10], to invoke a tool used by the Windows Store application, called AppInstaller.exe, to download and run whatever's on the other end of that link," he added.

Related Resource

How to reduce the risk of phishing and ransomware

Top security concerns and tips for mitigation

Large letter 'O' against a background of a city - whitepaper from MimecastFree download

This link points to a 482-byte text file named Adobe.appinstaller. The contents of that file are just plain text, in XML format, that points to a URL where a larger file containing the malware, named Adobe_1.7.0.0_x64.appbundle, was located.

The malicious appinstaller indicates the .appxbundle was digitally signed by a UK-based company calling itself Systems Accounting Limited. This certificate was issued several months ago, and Sophos contacted Sectigo to alert it about this abuse of the certificate it issued.

Victims then get asked to allow an "Adobe PDF Component” install. If this is allowed, Bazarloader is installed.

“Malware that comes in AppX packages is novel, but now that the process has been demonstrated, it’s likely to be here to stay. These apps are supposed to be digitally signed with certificates, but it doesn’t appear that there’s any mechanism to make a sanity check between what’s on the certificate and the code it’s supposed to certify,” said Brandt.

Featured Resources

The challenge of securing the remote working employee

The IT Pro Guide to Sase and successful digital transformation

Free Download

VMware Cloud workload migration tools

Cloud migration types, phases, and strategies

Free download

Practices for maximising the business value of digital infrastructure Consumption-as- a-Service subscriptions

IDC PeerScape

Free Download

Container network security guide for dummies

Enforcing Kubernetes best practices

Free download

Recommended

Meta files lawsuit to uncover hackers targeting Facebook, WhatsApp
phishing

Meta files lawsuit to uncover hackers targeting Facebook, WhatsApp

21 Dec 2021
Five things to consider before choosing an MFA solution
Security

Five things to consider before choosing an MFA solution

17 Dec 2021
Australia and US sign CLOUD Act data-sharing deal to support criminal investigations
cyber crime

Australia and US sign CLOUD Act data-sharing deal to support criminal investigations

16 Dec 2021
UK unveils £2.6 billion National Cyber Strategy
Policy & legislation

UK unveils £2.6 billion National Cyber Strategy

15 Dec 2021

Most Popular

How to move Microsoft's Windows 11 from a hard drive to an SSD
Microsoft Windows

How to move Microsoft's Windows 11 from a hard drive to an SSD

4 Jan 2022
Microsoft Exchange servers break thanks to 'Y2K22' bug
email delivery

Microsoft Exchange servers break thanks to 'Y2K22' bug

4 Jan 2022
Solving cyber security's diversity problem
Careers & training

Solving cyber security's diversity problem

5 Jan 2022