According to new research from Intel 471, cybercriminals have been increasingly using messaging apps to plan and deliver malware campaigns.

This is in part due to features many of the platforms offer. Some, such as Discord and Telegram, allow users to create and share programs inside the platform.

These programs, often called ‘bots,’ allow users to share media, play games, moderate channels, or any other automated task a developer can devise.

However, Intel 471 has observed cybercriminals using these messaging apps to spread malware.

Primarily used in conjunction with information stealers, cybercriminals have found ways to use these platforms to host, distribute, and execute various functions that ultimately allow them to steal credentials or other information from unsuspecting users.

Many of these information stealers are freely available to download. They have the capacity to steal autofill data, credentials, payment card information, cryptocurrency wallets, and passwords.

Intel 471 pointed to one stealer, Blitzed Grabber, that uses Discord’s webhooks feature to store data that is exfiltrated through the malware.

Webhooks provide an easy way to have automated messages and data updates sent from a victim’s machine to a particular messaging channel. Once the malware spits that stolen information back into Discord, actors can then use it to continue their own schemes or move to sell the stolen credentials on the cybercrime underground.

Furthermore, threat actors are also using the apps’ cloud infrastructure to support malware-spreading campaigns. With the links open to any users without authentication, they give threat actors a reputable web domain to host malicious payloads.

In research presented earlier this year at Scot-Secure 2022, Senior Lecturer of Criminology at the University of Surrey Dr Michael McGuire warned that much of the discussions around hacking takes place in plain sight on conventional social media platforms.

There, he warned, hackers share tips on vulnerabilities, train one another and provide tools.

In fact, according to McGuire’s research, social media platforms provide $3 billion to the cybercrime economy, and that between 2017 and 2020, there was 300% increase in the use of social media to facilitate crime.

Recommended

• 15 Scottish Traveltech companies to watch
• British courts will soon be able to pay damages in Bitcoin
• Dundee chosen as location of new battery cell Megafactory

However, the use of messaging apps can occasionally backfire on cybercriminals.

An attempted cyber-attack on the Eurovision Song Content was thwarted largely because the hackers were openly discussing their plans on messaging apps.

By monitoring Telegram channels used by the hackers, Italian authorities gathered information to pre-empt and block the attacks and discover the criminals’ locations.

And in one case, hundreds of suspected criminals were arrested after using an “encrypted” messaging service that was actually run by the FBI.

ANOM was a messaging app developed for the FBI to include features such as duress passwords and remote message wiping, making it attractive for criminals. It was installed on customised devices that could only run ANOM, unable to receive calls or emails. The devices were then distributed among criminal organisations.

However, their messages were not encrypted and were in fact being read by law enforcement authorities in multiple countries. In total, 27 million messages were obtained, leading to the arrest of around 800 people.

Get the latest news from DIGIT direct to your inbox

Our newsletter covers the latest technology and IT news from Scotland and beyond, as well as in-depth features and exclusive interviews with leading figures and rising stars.

To subscribe, click here.