New Router DNS Hijacking Attacks Abuse Bitbucket to Host Infostealer

[sidemoon]

 Bitdefender researchers have recently found a new attack that targets home routers and changes their DNS settings to redirect victims to a malware-serving website that delivers the Oski infostealer as a final payload.

What’s interesting about the attack is that it stores malicious payloads using Bitbucket, the popular web-based version control repository hosting service. 

To make sure the victim doesn’t suspect foul play, attackers also abuse TinyURL, the popular URL-shortening web service, to hide the link to the Bitbucket payload. 

READ MORE »