Cybercriminals continue to evolve their social engineering techniques, and one recent campaign highlights just how effective simple deception can be when combined with technical precision. In this case, attackers created a fraudulent website impersonating Avast antivirus, tricking users into believing their systems were infected.
What makes this campaign particularly dangerous is not just the malware itself, but the psychological manipulation behind it. Victims are guided through a convincing but entirely fake virus scan, only to be handed a so-called “solution” that is actually malicious software known as Venom Stealer.
This report breaks down how the attack works, what the malware does once inside a system, and why this method continues to succeed.
Threat Scenario: Fake Scan, Real Damage
The attack begins with a phishing website carefully designed to look like the official Avast platform. The layout includes familiar branding, navigation menus, and even trust indicators such as certification badges. At first glance, nothing appears suspicious.
Once a visitor lands on the page, they are encouraged to run a system scan. The process looks realistic—progress bars, animated checks, and console-style logs create a sense of legitimacy. However, everything displayed is pre-scripted.
The result is always the same:
- Three threats detected
- Three threats removed
- System marked as protected
To reinforce credibility, the scan references a known malware signature: Trojan:Win32/Zbot.AA!dll.
After this staged process, the user is prompted to download a file named Avast_system_cleaner.exe. This file is presented as a fix, but in reality, it is the entry point for the infection.
Payload Execution and Persistence Mechanism
Once executed, the file reveals its true purpose. The binary is a 64-bit Windows executable (~2 MB) that immediately copies itself into a deceptive location:
C:\Program Files\Google\Chrome\Application\v20svc.exe
This naming strategy is intentional. By placing itself inside a Chrome directory and adopting a service-like name, the malware blends in with legitimate processes. Most users—and even some analysts—could overlook it during casual inspection.
Interestingly, the copied file is identical to the original executable. Both share the same MD5 hash:
0a32d6abea15f3bfe2a74763ba6c4ef5
The malware then launches itself with a command-line argument:
--v20c
This parameter has no real function beyond signaling that the malware has transitioned into its second stage.
Malware Classification and Origin
Analysis shows that this sample belongs to the Venom Stealer family, which is derived from Quasar RAT. This lineage explains its modular design and strong data exfiltration capabilities.
A debug artifact embedded in the binary—crypter_stub.pdb—indicates the payload was packed using a crypter. This technique is widely used to evade antivirus detection by altering the file’s signature.
At the time of examination, only about 27% of antivirus engines flagged the sample. This low detection rate highlights how effective obfuscation remains against traditional signature-based defenses.
Data Theft Capabilities
Once active, Venom Stealer systematically targets sensitive data across the system.
Browser Data Extraction
The malware focuses heavily on web browsers. It extracts:
- Saved login credentials
- Session cookies
- Autofill data
During analysis, it accessed Firefox’s cookie database at:
C:\Users\<USER>\AppData\Roaming\Mozilla\Firefox\Profiles\<profile>\cookies.sqlite-shm
Additionally, memory inspection revealed structured JSON data containing session information from:
- Google Chrome
- Microsoft Edge
Affected services included:
- Netflix
- YouTube
- Outlook
- Adobe
Session cookies are particularly valuable because they allow attackers to bypass login credentials and even multi-factor authentication.
Cryptocurrency Wallet Targeting
Venom Stealer also scans for locally stored cryptocurrency wallets. If found, it attempts to extract wallet data.
For users storing funds in hot wallets, this creates immediate financial risk.
System Artifacts and Tracking
The malware collects additional information to monitor and track the victim:
- Screenshot saved at:
C:\Users\<USER>\AppData\Local\Temp\screenshot_5sIczFxY95t2IQ5u.jpg
- Session tracking file:
C:\Users\<USER>\AppData\Roaming\Microsoft\fd1cd7a3\sess
- Marker file:
C:\Users\Public\NTUSER.dat
The use of familiar file names and locations helps avoid raising suspicion.
Command-and-Control Communication
All stolen data is transmitted to a single domain:
app-metrics-cdn[.]com
This domain resolved to:
104.21.14.89
The naming is deliberate—it resembles a legitimate analytics or CDN service, similar to infrastructure used by companies like Cloudflare.
Exfiltration Flow
The malware communicates over unencrypted HTTP using a structured sequence:
- Upload stolen files (~140 KB)
- Send JSON data (~29 KB)
- Confirm completion
- Maintain heartbeat communication
Endpoints used:
/api/upload
/api/upload-json
/api/upload-complete
/api/listener/heartbeat
Traffic uses a generic browser user-agent:
Mozilla/5.0
This helps blend malicious traffic with normal browsing activity.
Evasion Techniques
Venom Stealer includes several advanced evasion strategies:
- Direct system calls to bypass monitoring tools
- Debugger detection
- CPU and hardware fingerprinting
- Volume serial number checks
- Process enumeration
- Guard pages to disrupt analysis
- Sleep delays exceeding three minutes
These techniques are designed to evade sandboxes and endpoint detection systems.
Historical Context
This type of attack is not new. Impersonating security software has been a common tactic for years.
A similar campaign documented in May 2025 involved attackers cloning Bitdefender and distributing malware using the same scare-and-fix approach.
The pattern is consistent:
- Build trust through branding
- Create urgency through fake threats
- Deliver malware disguised as protection
Incident Response Recommendations
If a system is suspected to be affected:
- Check for:
C:\Program Files\Google\Chrome\Application\v20svc.exe
- Run a full scan using trusted tools like Malwarebytes
- Reset all passwords immediately
- Log out of all active sessions
- Transfer cryptocurrency funds to a secure wallet
Indicators of Compromise (IOCs)
File Hash
SHA-256: ecbeaa13921dbad8028d29534c3878503f45a82a09cf27857fa4335bd1c9286d
Domain
app-metrics-cdn[.]com
IP Address
104.21.14.89
C2 URLs
http://app-metrics-cdn[.]com/api/upload
http://app-metrics-cdn[.]com/api/upload-json
http://app-metrics-cdn[.]com/api/upload-complete
http://app-metrics-cdn[.]com/api/listener/heartbeat
Our Analysis and Opinion
From a defensive standpoint, this campaign highlights a recurring weakness in cybersecurity: human trust. The attackers did not rely on exploiting software vulnerabilities or zero-day flaws. Instead, they exploited user behavior. By presenting a familiar interface and triggering fear, they guided victims into installing malware themselves.
What stands out in this case is the balance between simplicity and effectiveness. The fake scan is not technically advanced, yet it is convincing enough for non-technical users. This reinforces the idea that attackers do not always need sophisticated tools—sometimes, a well-crafted illusion is enough.
Another important observation is the continued effectiveness of masquerading techniques. Placing the malicious file inside a Chrome directory and naming it like a legitimate service shows how attackers understand both system structure and user psychology. Even experienced users may overlook such details unless they are actively investigating.
The use of crypters and low antivirus detection rates also raises concerns. Signature-based detection alone is clearly insufficient against modern threats. Behavioral monitoring and zero-trust approaches are becoming essential.
From a network perspective, the use of HTTP instead of HTTPS is interesting. While it may seem outdated, it actually works in the attacker’s favor. Many systems still allow outbound HTTP traffic without strict inspection, making it easier for data exfiltration to go unnoticed.
Perhaps the most concerning aspect is how repeatable this attack model is. As seen with previous campaigns involving Bitdefender, this is not a one-time operation. It is a template that can be reused with different brands, domains, and payloads.
In our view, the long-term solution is not purely technical. While better detection tools are necessary, user awareness remains critical. Organizations must invest in educating users about phishing, fake downloads, and brand impersonation. Without that, even the most advanced security stack can be bypassed through simple deception.
Ultimately, this case serves as a reminder that cybersecurity is not just about defending systems—it is about understanding human behavior and anticipating how it can be manipulated.
