New NetDooka malware spreads via poisoned search results
By Bill Toulas, Bleeping Computer A new malware framework known as NetDooka has been discovered being distributed through the PrivateLoader pay-per-install (PPI) malware distribution service, allowing threat actors full access to an infected device. This previously undocumented malware framework features a loader, a dropper, a protection driver, and a powerful RAT component that relies on a custom network communication protocol. The first samples of NetDooka were discovered by researchers at TrendMicro, who warn that while the tool is still in an early development phase, it is already very capable. The fact that it’s being distributed through the PrivateLoader malware distribution service reflects this potency, as its authors deemed the malware ready for large-scale deployment. PrivateLoader deployment The PrivateLoader PPI service was first spotted a year ago and analyzed by Intel471 in February 2022. In short, it’s a malware distribution platform that relies on SEO poisoning and lace...