Report Reveals Open-Source Malware Captures Images Of Victims Watching Porn

A recent report published by researchers at Proofpoint revealed that malicious actors have been using open-source malware labeled for “educational purposes” across multiple platforms to conduct cyberattacks. The experts discovered that this year, attackers employed automated infostealers in various campaigns, including taking pictures when users watch pornography for sextortion purposes.

According to the report published by Proofpoint on Wednesday, the open-source malware studied—Stealerium and similar variants—have been publicly available on platforms such as GitHub “for educational purposes only” for a long time. However, the researchers noticed recent malicious activity related to the infostealer.

“While open-source malware can be helpful for detection engineers and threat hunters to understand the patterns of behavior for which they can develop threat detection signatures, it also provides a different kind of education to malicious actors,” explained the researchers in the analysis. “These actors may adopt, modify, and possibly improve the open-source code, resulting in a proliferation of variants of the malware that are not so easy to detect or defend against.”

The researchers discovered multiple attacks targeting hundreds of organizations across the globe attributed to the threat actors TA2715 and TA2536, and linked to Stealerium. The campaigns used phishing emails with malicious attachments, impersonated organizations across various sectors, demanded payments, and applied social engineering tactics designed to instill fear and urgency.

In one case, malware installed on a victim’s device stole a wide range of data and included a pornographic-content detection feature. When adult content was recognized in a browser URL, it triggered screenshots and webcam captures.

“It’s able to detect adult content-related open browser tabs and takes a desktop screenshot as well as a webcam image capture,” wrote the researchers. “This is likely later used for ‘sextortion.’ While this feature is not novel among cybercrime malware, it is not often observed.”

Proofpoint warned of the risks posed by open-source malware and the likelihood of a new wave of cyberattacks, urging organizations to strengthen their defenses.

In recent weeks, multiple sextortion campaigns have been reported. In May, multiple outlets reported that the “Hello Pervert” campaign had been targeting many email users, and experts have also raised concerns about the use of AI for sextortion schemes on dating apps.