Theft Among JavaScript

Consider following on social media!

• WordPress
• Twitter
• Facebook

Quick note: if you’re viewing this via email, come to the site for better viewing. Enjoy!

The internet is a wide and, in some cases, unknown territory for many people to be on. Most of us simply surf the internet without a second thought as to how it works and let’s be honest some of us don’t really care to know how it does what it does.

We just want our cat videos and to be able to find that video where Gam Gam accidentally set her hair ablaze trying to blow out a candle. No matter what your reason for surfing online, you have to be aware that while surfing, many things lurk underneath or within.

Depending on who you ask. Small nerd fact, the web pages you view, including this one, have three main components. HTML (Hyper Text Markup Language) is what gives the page its layout that you see, the CSS (Cascading Style Sheets) gives the page its “pretty colors” and some effects, and finally, JS (JavaScript) gives the page the functionality to do certain things.

Within JS comes other languages like Node.js however, with more languages comes more problems. We’re going to be going over what the attack is, who is using it, the effects upon release, and what are some ways you can stay safe on your current webpage.

The Attack

Now you may be wondering why Node.js is being put under the microscope and not JS, and we have your answer. We’re looking at all of them because each one plays a part in a threat actor’s plan.

It all starts with Node.js and NodeStealer, NodeStealer is a malware that is written in JS language and is executed in Node.js. Told you that we were going to be looking at all of them.

You can think of this as that Russian doll thing that houses another smaller version of the bigger one. Just know, your problems are coming from within.

Who Can It Be Now

Are you wondering as to who has been using this nasty little trick? Well, so are we. This malware has been out for some time, and no one has made a name for using it.

This just goes to show there are too many threat actors out in the world to keep track. In most cases, threat actors never get caught because there are too many and attacks from the same one are so infrequent.

With infrequent attacks, comes fewer chances of finding the malicious actors.

Enjoy the read so far? Why don’t you consider subscribing so you can keep up to date?

That Sinking Feeling

Are you worried about how something like this could creep its way onto your computer? Don’t worry, Z-Daddy has you on that one. NodeStealer can be distributed by various means.

This could include but is not limited to phishing emails, malvertising, and bundling NodeStealer with software that is legitimate. Once NodeStealer is in, it disguises itself as a harmless document. This would be something like a PDF file which would have an appropriate icon and filename.

This is done with the intent to trick the victim into interacting with it. Once that happens the malware can execute and stay on the machine by establishing a persistence. This means even if you turn off your machine and boot it back up, the malware is still there.

The main objective is to obtain your collection of stored passwords, session information, and other possibly useful information.  A thing to note is that it was designed to go after certain web browsers such as Chrome, Opera, Microsoft Edge, and Brave. Before you think about it, no, this is not the movie “Brave.” Brave’s icon is a lion, not a little girl trying to break free from her father’s shadow.

The Prevention

You’re interested in protecting yourself from this malware, you say. Good, there are some useful tips, however, keep in mind that there is no such thing as 100% protection. Even hand sanitizer says 99.9%, and that covers both hands.

Some basic security measures like being mindful of who sent you an email with links or attachments that were unwarranted. Keeping your operating system up to date and anti-virus software is a must as patches are released to close vulnerabilities.

On a small scale, this can be easily done, but on a larger scale such as with a company with 1,000 employees, this form of protection is easier said than done. This is due to going through the motions which end up with a lot of complacent workers.

It has been said that having one complacent employee is enough to compromise your whole system, a few more, and that could sink your whole company.

Made it this far and found this to be entertaining? Then a big thanks to you and please show your support by cracking a like, sharing this with whomever, scripting a comment, or plug-in to follow.

Would like to give sincere thanks to current followers and subscribers, your support and actions mean a lot and has a play in the creation of each script.

Do you feel like there is something I may have missed on NodeStealer? Script a comment below.