CoffeeLoader utiliza vulnerabilidade no software da ASUS para comprometer sistemas. Especialistas em segurança alertam que vírus raramente é detectado

Cuidado, usuários do Armoury Crate, da ASUS: CoffeeLoader, o novo malware que se esconde em GPUs, é uma ameaça que não pode ser ignorada!

Detect malware named CoffeeLoader, which uses stealthy detection evasion methods and is spread via SmokeLoader, with Sigma rules from SOC Prime Platform.

CoffeeLoader impersonates Armoury Crate, which manages ASUS and ROG software and peripherals, and infects your Windows machine with an infostealer that's nearly impossible to detect.

New CoffeeLoader malware uses advanced GPU packing & evasion techniques; researchers urge caution. #malware #cybersecurity #CoffeeLoader

ゲーマーの皆さんは、ASUSのユーティリティを装った新手のマルウェア「CoffeeLoader」に気をつけましょう。 CoffeeLoaderは、ASUSやROG（ASUSのゲーミングブランドRe

There’s a new family of malware that’s impersonating Asus’s Armoury Crate software and infecting PCs with malicious code. The malware known as CoffeeLoader may sound like a futuristic kitchen appliance that automatically pours you some morning brew, but its intent is much more nefarious. Once it has infected your PC, it connects to a server to download additional malware in the form of an infostealer, then steals your information and credentials. Armoury Crate is Asus’s proprietary gaming app for the company’s lineup of gaming PCs. It allows users to control critical aspects of their gaming performance, including their PC’s operating mode, the speeds of fans, and more. Gamers using Asus’s desktop PCs and gaming laptops are at risk of infection, since these are things most gamers will want to do. The thing that makes CoffeeLoader so gnarly is how well-coded it is to infect gamer PCs. Not only does it mimic Asus’s software, but it also uses a packer called “Armoury” that loads part of its code onto the victim’s GPU (or graphics card). Since all users with Asus gaming PCs have GPUs, they’re vulnerable to this technique. And the fact that it targets a user’s GPU rather than their CPU is also a sneaky way for the malware to evade detection, since most virus scanners don’t typically scan the GPU. The CoffeeLoader malware mimics Asus’s Armoury Crate app. Mark Hachman / Foundry The CoffeeLoader malware also uses other techniques to avoid being discovered by antivirus software. One is called Sleep Obfuscation, whereby it locks itself up in system memory within an inactive, encrypted file that can’t be read. The malware also utilizes unusual pathways to remain unnoticed, such as Windows fibers (which are utilized by a user’s PC when they’re multitasking). Additionally, CoffeeLoader can carry out Call Stack Spoofing to eradicate traces of itself. Typically, when programs run, they leave traces of code behind like footprints in the snow. But CoffeeLoader is able to change the code it leaves behind just enough to appear like a benign program, thus fooling antivirus programs looking for traces of malicious code. Zscaler, the cybersecurity firm that discovered the malware, dates CoffeeLoader back to September 2024. With it having technical similarities to another malware called SmokeLoader, they surmise that this could point to CoffeeLoader being a new variant of that malware. But it’s too early to say for sure. Right now, the best way to avoid infection with CoffeeLoader is to ensure you download Asus’s Armoury Crate software directly from the company’s website rather than any third-party site.

CoffeeLoader is a new malware loader that employs stealthy techniques including call stack spoofing, sleep obfuscation, and Windows fibers to evade detection.

CoffeeLoader is a new malware loader that employs stealthy techniques including call stack spoofing, sleep obfuscation, and Windows fibers to evade detection.

Un nouveau malware, aux relents amers, CoffeeLoader, se fait passer pour l'application Armoury Crate d'Asus. Il infecte les PC des joueurs en chargeant son code directement sur le GPU plutôt que sur l...

CoffeeLoader impersonates Armoury Crate, which manages ASUS and ROG software and peripherals, and infects your Windows machine with an infostealer that's nearly impossible to detect.

CoffeeLoader is a sophisticated malware that uses numerous techniques to bypass security solutions, Zscaler ThreatLabz warns.

A new loader spotted sporting some creative solutions

Defenders have observed CoffeeLoader, a new stealthy malware that evades security protection using advanced evasion techniques and takes advantage of Red Team methods to boost its effectiveness. Distributed via SmokeLoader, CoffeeLoader implements secondary payloads while evading detection, making its stealthy attacks challenging to detect and defend against. Detect CoffeeLoader With more than 1 billion malware strains currently circulating the cyber threat arena and over 300 malware pieces created daily, staying on guard against emerging threats is more critical than ever. Yet, as attack surfaces expand and infiltration tactics evolve, early intrusion detection remains a complex challenge.

CoffeeLoader is a sophisticated malware that uses numerous techniques to bypass security solutions, Zscaler ThreatLabz warns. Zscaler ThreatLabz discovered CoffeeLoader, a malware family active since September 2024, that uses multiple techniques to evade endpoint security while downloading second-stage payloads. The advanced techniques used by the malware include GPU-based packing, call stack spoofing, sleep obfuscation, and […]

Cybersecurity researchers are calling attention to a new sophisticated malware called CoffeeLoader that's designed to download and execute secondary payloads. The malware, according to Zscaler ThreatLabz, shares behavioral similarities with another known malware loader known as SmokeLoader.  "The purpose of the malware is to download and execute second-stage payloads while evading

Zscaler ThreatLabz discovered a new malware family called CoffeeLoader, emerging around September 2024. CoffeeLoader's primary function is to download and execute second-stage payloads while bypassing endpoint security. It employs techniques like GPU-based packing, call stack spoofing, sleep obfuscation, and Windows fibers to evade detection. CoffeeLoader is distributed via SmokeLoader, exhibiting some shared behavioral traits. The malware uses a packer named Armoury, which executes code on the GPU to hinder analysis. Armoury performs an XOR operation with two 32-byte strings to derive a key for GPU kernel function execution. CoffeeLoader droppers install the malware, sometimes bypassing UAC and establishing persistence through scheduled tasks. The CoffeeLoader stager injects the main module into a suspended dllhost.exe process. The main module utilizes call stack spoofing to mask function call origins and avoids inline user-mode hooks by making indirect system calls. Sleep obfuscation encrypts code and data during sleep states to hide from memory scans.