Phlox Tempest is a threat actor conducting click fraud campaigns by distributing ChromeLoader malware through ISO files.
Analyst brief
Phlox Tempest (also tracked as DEV-0796) is a threat actor conducting a large-scale click fraud campaign, primarily via malicious YouTube comments and ads. They rely on ChromeLoader malware delivered as ISO image files, which victims are tricked into downloading and mounting. The attackers profit through clicks generated by installed malicious browser extensions or node-WebKit on compromised devices. Defenders should focus on user awareness regarding ISO file downloads, monitoring for suspicious browser extension and node-WebKit activity, and implementing ad-blocking measures.
Phlox Tempest
DEV-0796
unknown
Phlox Tempest is a threat actor responsible for a large-scale click fraud campaign targeting users through YouTube comments and malicious ads. They use ChromeLoader to infect victims' computers with malware, often delivered as ISO image files that victims are tricked into downloading. The attackers aim to profit from clicks generated by malicious browser extensions or node-WebKit installed on the victim's device. Microsoft and other cybersecurity organizations have issued warnings about this ongoing and prevalent campaign.