Spyware found stealing Iranian user data via infected VPN installer
Scripts from monitoring software found in Iranian VPN 20Speed
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Spyware has been discovered stealing Iranian users data via an infected VPN installer,antivirusproviderBitdefenderhas revealed.
The company’s joint-research with cybersecurity firm Blackpoint found components of Iranian-made EyeSpy malware to be injected “through Trojanized installers ofVPNsoftware (also developed in Iran).”
The majority of targets were within the country’s borders, only a few victims were found to be based in Germany and the US.
This is particularly concerning in a country like Iran, where using one thebest VPNservices has increasingly become a necessity. Whether this is for bypassing its strict online censorship, or preserving anonymity to avoid dangerous government surveillance. Most likely, a mix of both.
At the same time, a harsh crackdown on Iranian VPN services might push people towards unsecure third-party vendor sites. This makes such a spyware campaign even more dangerous for Iranians' privacy and security.
Anti-dissident spware?
“In light of the recent events, it’s possible that the targets are Iranians who want to access the internet via a VPN to bypass the country’s digital lockdown. Such malicious installers could plant spyware on people who pose a threat to the regime,“Bitdefender’s reportnoted.
Developed by Iranian-based firm SecondEye, EyeSpy is a legit monitoring software sold to businesses as a way to monitor employees' activities working remotely.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
The attackers were observed using components of the legit application in a malicious way to infect users' downloading the Iranian-based VPN service 20Speed and spy on their activities.
Once injected into a device, themalwarecan virtually spy on every activity and collect a tons of sensitive data. These include stored passwords, crypto-wallet data, documents and images, contents from clipboard, and logs key presses.
“The components of the malware are scripts that steal sensitive information from the system and upload them to an FTP server belonging to SecondEye,” Bitdefender explained.
State-backed Iranian hackers spread malware through links to fake VPN apps>Are VPNs really safe? How to check your service’s security>Our pick of the most secure VPN providers around right now
“This can lead to complete account takeovers,identity theftand financial loss. Moreover, by logging keypresses, attackers can obtain messages typed by the victim on social media or e-mail, and this information can be used to blackmail the victims.”
The campaign appears to be active since May 2022, with a growing number of attacks following the wave of anti government protests began in September.
VPN downloads in Iran skyrocketedfollowing this, reaching a peak of more than 3,000% increase by the end of the month.
A VPN islargely used by Iranian citizens to access restricted apps like Instagram andWhatsApp. But, as the government increasingly charges dissidents with harsh sentences even reaching the death penalty, extra security software is also a necessity to safeguard sensitive data.
While more and more Iranians download a virtual private network on their devices, authorities are hardly cracking down on reliable VPN services as a result.
Many providers are currently blocked in Iran, meaning that third-party VPN installers are increasingly in popularity. According toIran International, 20Speed VPN is actually one of the most popular websites where Iranians head to buy their VPN subscriptions. Over 100,000 are the active installations of itsAndroid VPNapp.
To fight against such malware campaigns, Bitdefender’s experts recommend “using well-known VPN solutions downloaded from legitimate sources. Also, a security solution, like Bitdefender, can protect against information stealers.”
Chiara is a multimedia journalist committed to covering stories to help promote the rights and denounce the abuses of the digital side of life—wherever cybersecurity, markets and politics tangle up.She mainly writes news, interviews and analysis on data privacy, online censorship, digital rights, cybercrime, and security software, with a special focus on VPNs, for TechRadar Pro, TechRadar and Tom’s Guide. Got a story, tip-off or something tech-interesting to say? Reach out to chiara.castro@futurenet.com
Should your VPN always be on?
3 reasons why PIA fell in our best VPN rankings
Phishing attacks surge in 2024 as cybercriminals adopt AI tools and multi-channel tactics
