Full Report
2025-02-18 • Proofpoint • Proofpoint Threat Research Team • apk.marcher, js.fakeupdates, osx.frigid_stealer, win.lumma Open article on Malpedia
Analysis Summary
The provided context is extremely brief and appears to be metadata/a placeholder for an article titled "An Update on Fake Updates: Two New Actors, and New Mac Malware" from Proofpoint. It lists several potential malware families (`apk.marcher`, `js.fakeupdates`, `osx.frigid_stealer`, `win.lumma`) but does *not* explicitly name or attribute the two new actors or detail their campaigns, motivations, or TTPs beyond the context of the "Fake Updates" theme and the listed malware.
Therefore, the summary must reflect the lack of specific detail in the provided text.
# Threat Actor: Undetermined (Associated with "Fake Updates" Theme)
## Attribution & Identity
Attribution of the new actors is not detailed in the provided context. The report title suggests the discovery of two new threat actors operating within the 'Fake Updates' ecosystem.
## Activity Summary
The activity centers around campaigns utilizing a "Fake Updates" theme, often involving masquerading as legitimate software updaters to distribute malware. The context mentions specific malware associated with this theme: `apk.marcher`, `js.fakeupdates`, `osx.frigid_stealer`, and `win.lumma`.
## Tactics, Techniques & Procedures
Specific actionable TTPs are not detailed in the provided text, but the common theme relates to:
- **Initial Access:** Distribution via lures that impersonate software updates (Fake Updates).
- **Malware Families observed/associated:**
- `osx.frigid_stealer` (suggests macOS focus)
- `win.lumma` (suggests Windows focus, Lumma Stealer family)
- `js.fakeupdates`
## Targeting
Targeting details are inferred based on the identified malware rather than explicit campaign descriptions:
- Sectors: Not specified in the context.
- Geography: Not specified in the context.
- Victims: Not specified in the context.
## Tools & Infrastructure
The following malware families are mentioned in association with the campaigns:
- Malware families used: `apk.marcher`, `js.fakeupdates`, `osx.frigid_stealer`, `win.lumma`.
- Infrastructure (C2, domains, IPs): None explicitly provided or defanged in the context.
## Implications
The existence of two new actors leveraging the effective "Fake Updates" lure suggests a continued, potentially expanding, threat landscape utilizing social engineering to achieve initial access across multiple operating systems (Windows and macOS).
## Mitigations
Specific mitigations are not detailed, but general defenses against "Fake Updates" campaigns would include:
- User education regarding legitimate software update channels versus unsolicited update prompts.
- Implementing strong endpoint detection and response (EDR) capable of detecting unusual process execution associated with downloaded update files.
- Monitoring for malware families such as Lumma Stealer or custom information stealers.