Moserpass Malware Spread Through Supply-chain Attack Involving Popular Password Manager

Supply-chain attack campaigns are one of the most difficult and dangerous methods that cybercriminals use to propagate malware. These attacks are executed by compromising a legitimate software vendor's network, and then planting malicious software in their update or installation packages. This way, non-suspecting users may end up with malware on their device even though they never visited suspicious websites, or interacted with dodgy files.

One of the recently popular supply-chain attacks involved multiple malware families that were embedded inside software packages distributed by the SolarWinds vector. Today, we will turn out attention to a similar attack, which was executed on a much smaller scale. The criminals behind it targeted the Passwordstate software, and they managed to plant a malicious piece of software inside a recent update. The threat, called Moserpass Malware, appears to have been specifically crafted to target this software product.

The Moserpass Malware behaves like an infostealer, but instead of targeting Web browsers, it goes after data stored by the Passwordstate software. Typically, this attack would not be effective since users tend to rely on all sorts of password managing software – however, Moserpass' creators know for certain that they will not compromise devices that have Passwordstate running on them.

Apart from Passwordstate data, the Moserpass Malware also hijacks significant amount of information about the compromised device – username, computer name, processes, hardware, software, and more. Surprisingly, the Moserpass Malware does not share similarities with previously known infostealers, so it is very likely that its authors have created it from scratch. It is important to add that the supply-chain attack was caught very quickly, therefore minimizing the consequences. Another thing worth mentioning is that modern antivirus products detect the Moserpass Malware easily, so users who use sufficient anti-malware protection were protected from the fraudulent update.

If you are a Passwordstate user, it is recommended to change all passwords immediately, and to run an antivirus scanner to check if your computer had been compromised by the Moserpass Malware.