Overview

This analysis focuses on a malware campaign that leverages a Google Docs feature to deliver distinct malware payloads to Mac and Windows users. The campaign, detailed in a Huntress blog post, demonstrates the adaptability of attackers in targeting multiple platforms and underscores the need for comprehensive security measures across different operating systems.

Understanding the Vulnerability / Threat

Root Cause Analysis

The root cause of this threat is not a vulnerability in Google Docs itself but rather a social engineering tactic that exploits user trust in Google's ecosystem. The campaign uses a malicious Google Doc that, when interacted with, triggers the download of different malware strains depending on the user's operating system.

Attack Surface & Vector

The attack vector involves a malicious Google Doc that users are tricked into accessing. This doc likely contains a link or content that, when accessed, redirects the user to a malicious site or triggers a script that delivers the appropriate malware payload based on the user's operating system (Mac or Windows).

Exploitation Mechanics — Scenario Walkthrough

Initial Position: An attacker creates a malicious Google Doc that appears legitimate but contains a link or script designed to exploit users.

Triggering the Flaw: The user, unaware of the malicious intent, clicks on the doc or interacts with it in a way that triggers the script. This script likely checks the user's operating system and then delivers the corresponding malware payload.

What Breaks: The security boundary that breaks is the user's trust in Google Docs and their failure to scrutinize the document's content or the links it contains. The technical chain reaction involves the execution of a script that identifies the operating system and downloads the appropriate malware.

Attacker's Prize: The attacker gains the ability to deploy either the AMOS stealer on Mac or NetSupport Manager on Windows. With these tools, the attacker can steal sensitive information (on Mac) or gain remote access to the system (on Windows), allowing for further malicious activities such as data exfiltration, lateral movement, or deployment of additional malware.

Real-World Impact

The real-world impact of this campaign includes the potential for widespread infection of both Mac and Windows systems, leading to data theft, unauthorized system access, and possible lateral movement within networks. While there is no indication that this campaign is actively exploited in the wild, the existence of such tactics highlights the need for vigilance.

Detection & Defense

Immediate Mitigations

- Users should exercise caution when interacting with Google Docs from unknown sources.

- Ensure that your operating system and all software are up to date.

- Use anti-virus software and keep it updated.

Detection Strategies

- Monitor for unusual network activity that could indicate communication with a command and control server.

- Implement SIEM rules to detect the presence of known malware signatures for AMOS stealer and NetSupport Manager.

Long-Term Hardening

- Implement a defense-in-depth strategy that includes cross-platform security measures.

- Educate users on the risks associated with interacting with documents from unknown sources.

- Regularly back up data and ensure that backups are secure.

Key Takeaways

  • Be cautious with documents from unknown sources, even if they appear to be from trusted services like Google Docs.
  • Implement comprehensive security measures that cover multiple platforms.
  • Regularly update and patch systems and software.
  • Use anti-virus software and keep it updated.

Sources

  • Huntress Blog: Google Doc Sidebar Sends Mac and Windows Users Down Different Paths to Malware