{"id":56368,"date":"2024-06-19T11:18:51","date_gmt":"2024-06-19T11:18:51","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/that-powershell-fix-for-your-root-cert-problem-is-a-malware-loader-in-disguise\/"},"modified":"2024-06-19T11:18:51","modified_gmt":"2024-06-19T11:18:51","slug":"that-powershell-fix-for-your-root-cert-problem-is-a-malware-loader-in-disguise","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/that-powershell-fix-for-your-root-cert-problem-is-a-malware-loader-in-disguise\/","title":{"rendered":"That PowerShell ‘fix’ for your root cert ‘problem’ is a malware loader in disguise"},"content":{"rendered":"

Crafty criminals are targeting thousands of orgs around the world in social-engineering attacks that use phony error messages to trick users into running malicious PowerShell scripts. <\/p>\n

This latest Windows malware distribution campaign uses fake Google Chrome, Microsoft Word, and OneDrive error messages that look kinda like real warnings. After visiting a legit but compromised website, victims see some kind of pop-up text box in their browser telling them something went wrong \u2013 it’s an old but highly effective trick. One worth knowing, we reckon, so that you can help stop colleagues and others falling for it.<\/p>\n

Marks are then instructed to click on a “fix” button, and then paste the displayed code into a PowerShell terminal or Windows Run dialog box. This allows PowerShell to run another remote script that downloads and runs the malware on the victim’s PC.<\/p>\n