Sextortion-based cybercrime, a particularly disturbing form of hacking, has evolved with the advent of automated spyware that captures victims’ webcam images while they browse pornography. This new threat, identified in a variant of the open-source “infostealer” malware known as Stealerium, automates the process of capturing compromising images, posing a significant privacy risk.

• Stealerium: A New Automated Threat
• Distribution and Open-Source Nature
• The Mechanism of Automated Sextortion
• Evolving Cybercriminal Strategies

Stealerium: A New Automated Threat

According to a recent analysis by security firm Proofpoint, Stealerium has been active in various cybercriminal campaigns since May of this year. This malware, like other infostealers, is designed to infiltrate a target’s computer and exfiltrate sensitive data such as banking details, login credentials, and cryptocurrency wallet keys. However, Stealerium introduces a more invasive feature by monitoring the victim’s browser for pornographic content and capturing images via the webcam, which are then sent to the hacker for potential blackmail.

Selena Larson, a researcher at Proofpoint, emphasizes the severity of this privacy invasion, stating, “When it comes to infostealers, they typically are looking for whatever they can grab. This adds another layer of privacy invasion and sensitive information that you definitely wouldn’t want in the hands of a particular hacker.” Larson further describes the tactic as “gross” and expresses her disdain for such invasive methods.

Distribution and Open-Source Nature

Proofpoint’s investigation into Stealerium revealed its distribution through tens of thousands of emails from two hacker groups, as well as other email-based hacking campaigns. Surprisingly, Stealerium is available as a free, open-source tool on GitHub, created by a developer known as witchfindertr, who claims the software is for “educational purposes only.” The developer disclaims responsibility for any illegal use, stating, “How you use this program is your responsibility. I will not be held accountable for any illegal activities. Nor do I give a shit how u use it.”

The malware is typically delivered via phishing emails that entice victims to download and install it, often using fake payment or invoice lures. These campaigns have targeted individuals within the hospitality, education, and finance sectors, though Proofpoint suggests that individuals outside these industries may also be at risk.

The Mechanism of Automated Sextortion

Once installed, Stealerium collects a wide array of data and transmits it to hackers through platforms like Telegram, Discord, or using the SMTP protocol. While these methods are standard for infostealers, the automated sextortion feature is particularly alarming. This feature uses a customizable list of pornography-related terms to trigger simultaneous captures from the user’s webcam and browser.

Though Proofpoint has not identified specific victims of this sextortion feature, its existence indicates a likely use in blackmail schemes. Traditional sextortion tactics have long been a part of cybercriminal arsenals, with scams often claiming to have obtained compromising webcam footage. However, the automation of such tactics, as seen in Stealerium, represents a new and concerning development.

Kyle Cucci, another Proofpoint researcher, notes that while sextortion scams are common, the automation of webcam captures is “pretty much unheard of.” The only similar case was a 2019 malware campaign targeting French-speaking users, discovered by Slovakian cybersecurity firm ESET.

Evolving Cybercriminal Strategies

The shift towards targeting individual users with automated sextortion features may reflect a broader trend among lower-tier cybercriminal groups. These groups appear to be moving away from high-profile ransomware attacks, which attract law enforcement attention, towards more discreet and individualized extortion schemes.

Larson explains, “For a hacker, it’s not like you’re taking down a multi-million dollar company that is going to make waves and have a lot of follow-on impacts. They’re trying to monetize people one at a time. And maybe people who might be ashamed about reporting something like this.”

The emergence of automated sextortion spyware like Stealerium highlights a concerning evolution in cybercrime, shifting towards more personalized and invasive forms of blackmail. While traditional infostealers target financial data, Stealerium’s ability to capture compromising webcam footage introduces a severe new layer of privacy risk. This trend underscores the need for heightened cybersecurity awareness and robust protective measures against sophisticated, automated threats.

Frequently Asked Questions

What is Stealerium and how does it pose a threat?

Stealerium is a variant of open-source ‘infostealer’ malware that automates the capture of webcam images while victims browse pornography, posing a significant privacy risk. It infiltrates computers to exfiltrate sensitive data and introduces a more invasive feature by monitoring browsers for pornographic content and capturing images for potential blackmail.

How is Stealerium distributed and who are its targets?

Stealerium is distributed through phishing emails, often using fake payment or invoice lures. These campaigns have targeted individuals within the hospitality, education, and finance sectors, though individuals outside these industries may also be at risk.

What makes the sextortion feature of Stealerium particularly alarming?

The sextortion feature of Stealerium is alarming because it automates the process of capturing compromising images via webcam when pornography-related terms are detected. This automation represents a new development in cybercriminal tactics, making it easier to blackmail victims.

Who is behind the creation of Stealerium and what is their stance on its use?

Stealerium was created by a developer known as witchfindertr, who claims the software is for ‘educational purposes only’ and disclaims responsibility for any illegal use. The developer states, ‘How you use this program is your responsibility. I will not be held accountable for any illegal activities.’

What trend does the use of Stealerium’s sextortion feature indicate among cybercriminals?

The use of Stealerium’s sextortion feature indicates a trend among lower-tier cybercriminal groups towards more discreet and individualized extortion schemes. These groups are moving away from high-profile ransomware attacks that attract law enforcement attention, opting instead to monetize individuals one at a time.