May 22, 2023

May 22, 2023 Company researchers Cyble have warned of websites offering a fake version of the popular video editing tool CapCut. The problem with these sites is that in addition to the fake tool, users will also download some of the malware that comes bundled with it. CapCut is the official video editing tool of ByteDance, the company that also owns TikTok. CapCut supports music mixing, color filters, animation, slow motion effects, picture in picture, stabilization and more. The app has over 500 million downloads on Google Play alone, and the CapCut website has more than 30 million visits per month. Considering that this tool is popular worldwide, but also banned in some countries like Taiwan and India, it is understandable that users are looking for alternative ways to download the program. Cybercriminals take advantage of this and offer a popular program that hides malware on their websites. It is about capcut-freedownload sites[. ]com, capcutfreedownload[. ]com, capcut-editor-video[. ]com, capcutdownload[. ]com, capcutpc-download[.]com. It is unclear how the victims were directed to these sites, none of which are currently operational. The first campaign spotted by the researchers uses fake CapCut sites with a download button that delivers the Offx Stealer malware to the user’s computer. This malware only works on Windows 8, 10 and 11. When the victim runs the downloaded file, they get a fake error message claiming that the application failed to launch. However, Offx Stealer continues to run in the background. The malware will attempt to extract passwords and cookies from web browsers and certain file types (.txt, .lua, .pdf, .png, .jpg, .jpeg, .py, .cpp, and .db) from folders on the user’s desktop . The malware will also try to steal data stored in messaging apps like Discord and Telegram, cryptocurrency wallet apps (Exodus, Atomic, Ethereum, Coinomi, Bytecoin, Guarda and Zcash) and remote access software like UltraViewer and AnyDesk . All stolen data is stored in a generated folder in %AppData%, compressed, and then sent to operators on a private Telegram channel, after which the folder created for temporary data storage is deleted to erase all traces of the infection. In another campaign involving fake CapCut sites, victims download a file called “CapCut_Pro_Edit_Video.rar”. Cyble says that at the time they noticed the campaign, no antivirus had flagged this file as malicious. However, the well-known Redline Stealer malware and the .NET executable are well hidden inside. Redline is information-stealing malware that can retrieve data stored in web browsers and applications, including credentials, credit cards, and autofill data. The role of the .NET file is to bypass the AMSI Windows security feature and allow Redline to run smoothly on a compromised system. To protect yourself from such malware, always download software directly from official sites, not from sites you’ve seen on forums, social networks or received a link to through a message, and also avoid paid ads in search results when searching for software on Google . CapCut is available on the official website capcut.com , Google Play (for Android) i App Store (for iOS).