VietCredCare Stealer Targets Victims in Vietnam

Since at least August 2022, advertisers on Facebook in Vietnam have been targeted by an unknown information-stealing malware known as VietCredCare. This malicious software is noteworthy for its automatic filtering of Facebook session cookies and stolen credentials from compromised devices. It evaluates whether the targeted accounts manage business profiles and maintain a positive Meta ad credit balance, according to a report from Singapore-based Group-IB.

The primary objective of this widespread malware distribution is to take over corporate Facebook accounts, focusing on Vietnamese individuals responsible for managing profiles of prominent businesses and organizations. Once successfully seized, these compromised accounts are utilized by threat actors to post political content or propagate phishing and affiliate scams for financial gain.

VietCredCare Sold as a Malware Service

VietCredCare operates under a stealer-as-a-service model and is advertised on platforms such as Facebook, YouTube, and Telegram. It is believed to be managed by individuals who speak Vietnamese. Potential customers can either purchase access to a botnet managed by the malware's developers or acquire the source code for resale or personal use. Additionally, customers are provided with a customized Telegram bot to handle the exfiltration and delivery of credentials from infected devices.

Distributed through links on fake sites in social media posts and instant messaging platforms, the .NET-based malware disguises itself as legitimate software like Microsoft Office or Acrobat Reader to deceive users into installing it. A key feature of VietCredCare is its capability to extract credentials, cookies, and session IDs from web browsers like Google Chrome, Microsoft Edge, and Cốc Cốc, emphasizing its focus on Vietnamese targets.

The malware can also retrieve a victim's IP address, determine if a Facebook account is a business profile, and assess whether the account is currently managing any ads. To avoid detection, it takes measures such as disabling the Windows Antimalware Scan Interface (AMSI) and adding itself to the exclusion list of Windows Defender Antivirus. Numerous credentials from government agencies, universities, e-commerce platforms, banks, and Vietnamese companies have been compromised through this stealer malware.