Fake Bitwarden Site Infects Windows Devices With ZenRAT

Cybersecurity researchers have discovered a new and concerning malware strain known as ZenRAT. This malicious software is taking advantage of unsuspecting Windows users by masquerading as Bitwarden, a trusted, open-source password manager. ZenRAT's intent is not to safeguard your passwords but to steal them.

The researchers at Proofpoint were alerted to this threat by Jérôme Segura, Senior Director of Threat Intelligence at Malwarebytes. The tactics used by the threat actors distributing the malware are deceptively simple yet highly effective.

These cybercriminals purchased a domain resembling the legitimate Bitwarden website — bitwariden[.]com. This technique, known as typosquatting, lures unsuspecting victims into visiting fake sites that closely mimic their trusted counterparts. While it remains unclear how these attackers drive traffic to their counterfeit Bitwarden website, researchers suspect various methods, including SEO poisoning, malvertising, or social engineering.

Nothing malicious occurs when users with Mac or Linux devices visit the deceptive site and click on the download link. They are redirected to a benign webpage. However, the same cannot be said for Windows users. Upon clicking the link, they unwittingly download and become infected with ZenRAT.

Once ZenRAT gains a foothold on a Windows system, it connects with a command and control (C2) server, enabling the cybercriminals to control the infected machine remotely.

From there, ZenRAT proceeds to extract valuable information. It conducts WMI queries to learn about the victim's CPU name, GPU name, operating system version, installed RAM, IP address, gateway, and any installed antivirus or other applications. Most alarmingly, it also harvests all browser data, including stored credentials, placing users' sensitive information at risk.

As of now, it remains uncertain how many individuals have fallen victim to ZenRAT and lost their passwords and other sensitive data in the process. To reduce these risks, users are urged to always verify a website's legitimacy before downloading files from it.