IDAT Loader: Fake Chrome Update to Stealer
A fake Chrome update page convinced an estimator their browser was out of date, and one installer later their saved passwords and wallet data were on their way to an unknown host. Follow the chain from a drive-by MSI through msiexec, a signed application side-loading the IDAT Loader, process injection, and StealC and Lumma infostealers to a single command-and-control endpoint.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Scope the intrusion
0The endpoint platform raised a side-loading alert on an estimator's workstation this afternoon, and shortly afterward the proxy logged a large outbound upload from the same machine to a host nobody recognizes. Before extracting indicators, orient yourself to the case so the pivots that follow make sense.
Find the fake update page
20The user did not receive a malicious email. While reading a supplier blog they were redirected to a page that claimed their browser was dangerously out of date and had to be updated at once. Identify the host that served that fake update page.
Recover the installer hash
20Convinced the browser needed updating, the user downloaded and ran a Windows installer styled as the update. Recover the SHA-256 hash of that installer so it can be blocked across the fleet.
Identify the side-loaded library
25The installer dropped a legitimate signed application into a temporary folder alongside a malicious library, then let the trusted binary load it. Name the library that the signed application side-loaded.
Recover the command-and-control host
25After the loader injected into a benign process, that process reached out to a single external host to fetch its configuration and, later, to send the stolen data. Recover the host the injected process called home to.
Classify the side-loading technique
15For the report, classify how the loader gained execution under a trusted process. Map the technique the signed application was abused with to its MITRE ATT&CK identifier.
6 tasks · 105 points total
Training Tools
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with SIEM concepts
- Familiarity with XDR concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allVidar: Fake Notepad++ Malvertising to Data Theft
A developer searched for a popular code editor, clicked a paid search ad, and ran an installer that was not the real thing. Follow the chain from a typosquatted landing page through a dynamic-DNS payload host to the Vidar stealer's dead-drop C2 resolution, then pin down the single hosting address that carried both the stolen data and the malware's orders.
EvilProxy AiTM: Indeed Redirect to M365 Cookie Theft
An executive at a logistics firm clicks a job-themed phishing link that abuses a recruiting platform's open redirect to reach an EvilProxy adversary-in-the-middle page. The page reverse-proxies the real Microsoft 365 sign-in, so the victim completes MFA against the attacker, who captures and replays the post-MFA session cookie. Work the email, web-proxy, DNS, Entra sign-in, and perimeter records to reconstruct the redirect chain, the relay infrastructure, and the MFA bypass.
SCARLETEEL: AWS Fargate Breach to Cloud Crypto-Mining
An internet-reachable JupyterLab notebook on AWS Fargate was exploited for code execution. The operator stole the task role credentials from the container metadata endpoint, replayed them to harvest Secrets Manager and SSM secrets, minted a new access key for persistence, read the Terraform state and a customer-ledger export, and finished by launching compute-optimized instances to mine cryptocurrency. Work the CloudTrail audit trail alongside the SIEM proxy, DNS, and firewall egress records to reconstruct the chain.