SYS01 Infostealer Campaign Exploits Meta Ads to Target Millions Worldwide

by do son · November 2, 2024

In a world increasingly dependent on online advertising, cybercriminals have seized an opportunity to exploit Meta’s vast advertising ecosystem. Bitdefender Labs has released an alarming report detailing the “SYS01 Infostealer” campaign, a sophisticated malvertising attack that leverages compromised Facebook Business accounts to distribute malicious ads across global platforms.

According to Bitdefender Labs, SYS01 is no ordinary infostealer—it’s a meticulously engineered tool deployed through social media ads, often disguised as well-known software or services. “The SYS01 InfoStealer malware has become a central weapon in this campaign, effectively targeting victims across multiple platforms,” Bitdefender reports. Delivered as an ElectronJs application, SYS01 leverages an impressive network of nearly a hundred malicious domains, each performing command and control (C2) functions to monitor and manage the malware in real time.

A distinctive feature of the SYS01 campaign is its widespread impersonation of trusted brands. Bitdefender Labs observes that hackers use “hundreds of ads impersonating popular video editing software like CapCut, productivity tools like Office 365, video streaming services such as Netflix, and even video games”. These deceptive ads reach millions of potential victims, especially users aged 45 and older, with a large number of ads going unnoticed by security systems. This impersonation tactic amplifies the credibility of the ads, making it nearly impossible for users to differentiate between legitimate promotions and malicious intent.

Bitdefender’s report emphasizes that SYS01’s success hinges on the hijacking of Facebook Business accounts, which are subsequently used to propagate malicious ads. “Once hackers gain access to these accounts, they don’t just exploit the personal data; they use the hijacked accounts to launch more malicious ads,” explains Bitdefender. By leveraging legitimate accounts, the ads bypass security measures, allowing the campaign to scale efficiently while maintaining a low profile.

The creators of SYS01 employ advanced evasion tactics, updating malware to evade detection. “When cybersecurity firms begin to flag and block a specific version of the loader, the hackers respond swiftly by updating the code,” Bitdefender highlights, describing how the attackers stay ahead of security defenses. This adaptability enables the SYS01 campaign to remain effective, maintaining its threat across various regions, including North America, Europe, Asia, and Australia.