Threat Actors Use JSON Services for Malware Delivery

Threat actors have updated their tactics by using JSON storage services to host and deliver malware. The campaign involves targeting software developers through professional networking sites, instructing them to download trojanized code projects. These projects contain Base64-encoded values that lead to JSON storage services, where the next-stage payload, a JavaScript malware known as BeaverTail, is stored. BeaverTail harvests sensitive data and drops a Python backdoor called InvisibleFerret, which fetches additional payloads. The campaign's success underscores the actors' ability to operate stealthily and blend in with normal traffic.