Beware: Tainted VPNs Being Used to Spread EyeSpy Surveillanceware – The Hacker News


Jan 13, 2023Ravie LakshmananVPN / Surveillanceware

Tainted VPN installers are being used to deliver a piece of surveillanceware dubbed EyeSpy as part of a malware campaign that started in May 2022.

It uses “components of SecondEye – a legitimate monitoring application – to spy on users of 20Speed VPN, an Iranian-based VPN service, via trojanized installers,” Bitdefender said in an analysis.

A majority of the infections are said to originate in Iran, with smaller detections in Germany and the U.S., the Romanian cybersecurity firm added.

SecondEye, according to snapshots captured via the Internet Archive, claims to be a commercial monitoring software that can work as a “parental control system or as an online watchdog.” As of November 2021, it’s offered for sale anywhere between $99 to $200.

It comes with a wide range of features that allows it to take screenshots, record microphone, log keystrokes, gather files and saved passwords from web browsers, and remotely control the machines to run arbitrary commands.

SecondEye previously came under the radar in August 2022, when Blackpoint Cyber revealed the use of its spyware modules and infrastructure for data and payload storage by unknown threat actors. The initial access mechanism used in these incidents is currently unknown.

Bogdan Botezatu, director of threat research and reporting at Bitdefender, told The Hacker News that despite the use of the same spyware components, there is not enough evidence to connect the two sets of activities to a single campaign.

The latest attack chain begins when an unsuspecting user downloads a malicious executable from 20Speed VPN’s website, indicating two plausible scenarios: Either that the its servers were breached to host the spyware or it’s a deliberate attempt to spy on individuals who might download VPN apps to bypass internet blackouts in the country.

Once installed, the legitimate VPN service is launched, while also stealthily kicking off a train of nefarious activities in the background so as to establish persistence and download next-stage payloads for harvesting personal data from the host.

“EyeSpy has the ability to fully compromise online privacy via keylogging and stealing of sensitive information, such as documents, images, crypto wallets, and passwords,” Bitdefender researcher Janos Gergo Szeles said. “This can lead to complete account takeovers, identity theft and financial loss.”

Found this article interesting? Follow us on Twitter and LinkedIn to read more exclusive content we post.




What is a VPN? Can it really protect my online privacy and security? – Fox News

Privacy has never been in such short supply.  There’s one technology I’ve found essential to fighting back against big tech’s prying and spying routine.   A VPN, or virtual private network, can be a very good idea for you to secure your internet connection, and it can be an effective way for you to protect your online privacy and security.


Read More

How to Pick a VPN for Torrenting – How-To Geek


When you pick a VPN for torrenting, you need to look out for a few key security features, like a kill switch and transparent no-log policy. Also, avoid United States-based VPN providers and servers.

If you’re going to torrent, you’re going to need a VPN to protect yourself while doing so. How do you pick a good VPN for torrenting, though, is there something …….

Read More

The best Thailand VPN in 2023 – TechRadar

Thailand isn’t just beautiful beaches, breath-taking jungles, playful monkeys and yummy Pad Thai. Something that tourists often forget is that authorities are infamous for their strong grip on the internet. That’s where the best Thailand VPN apps can come handy.

Following the 2006 military coup d’état, online censorship and surveillance have been growing year by year. Now beyond solely …….

Read More