Cybercriminals Use Eclipse Jarsigner to Deploy XLoader Malware via ZIP Archives

The Hacker News

Factuality

Ownership

Cybercriminals Use Eclipse Jarsigner to Deploy XLoader Malware via ZIP Archives

A malware campaign distributing the XLoader malware has been observed using the DLL side-loading technique by making use of a legitimate application associated with the Eclipse Foundation. "The legitimate application used in the attack, jarsigner, is a file created during the installation of the IDE package distributed by the Eclipse Foundation," the AhnLab SEcurity Intelligence Center (ASEC)

unsafe.sh

Factuality

Ownership

Threat actors use the legitimate Java signing tool jarsigner.exe to deploy XLoader malware, bypassing security measures through DLL side-loading technology, mainly targeting developers and organizations using Eclipse IDE. The attack package contains disguised jarsigner.exe and malicious DLL files, and executes malicious code by tampering with DLL export functions.

GBHackers On Security

Factuality

Ownership

Hackers Exploit Jarsigner Tool to Deploy XLoader Malware

Security researchers at AhnLab Security Intelligence Center (ASEC) have uncovered a new campaign leveraging the legitimate JAR signing tool, jarsigner.exe, to distribute the XLoader malware. The attack employs a DLL side-loading technique, where malicious DLL files are placed alongside legitimate executable files to ensure their execution when the legitimate application is run. This method exploits […] The post Hackers Exploit Jarsigner Tool to …