Spyware found stealing Iranian user data via infected VPN installer

Spyware has been discovered stealing Iranian users data via an infected VPN installer, antivirus provider Bitdefender has revealed.

The company's joint-research with cybersecurity firm Blackpoint found components of Iranian-made EyeSpy malware to be injected “through Trojanized installers of VPN software (also developed in Iran).”

The majority of targets were within the country's borders, only a few victims were found to be based in Germany and the US.

This is particularly concerning in a country like Iran, where using one the best VPN services has increasingly become a necessity. Whether this is for bypassing its strict online censorship, or preserving anonymity to avoid dangerous government surveillance. Most likely, a mix of both.

At the same time, a harsh crackdown on Iranian VPN services might push people towards unsecure third-party vendor sites. This makes such a spyware campaign even more dangerous for Iranians' privacy and security.

Anti-dissident spware?

“In light of the recent events, it’s possible that the targets are Iranians who want to access the internet via a VPN to bypass the country’s digital lockdown. Such malicious installers could plant spyware on people who pose a threat to the regime,” Bitdefender's report (opens in new tab) noted.

Developed by Iranian-based firm SecondEye, EyeSpy is a legit monitoring software sold to businesses as a way to monitor employees' activities working remotely.

The attackers were observed using components of the legit application in a malicious way to infect users' downloading the Iranian-based VPN service 20Speed and spy on their activities.

Once injected into a device, the malware can virtually spy on every activity and collect a tons of sensitive data. These include stored passwords, crypto-wallet data, documents and images, contents from clipboard, and logs key presses.

“The components of the malware are scripts that steal sensitive information from the system and upload them to an FTP server belonging to SecondEye,” Bitdefender explained.

“This can lead to complete account takeovers, identity theft and financial loss. Moreover, by logging keypresses, attackers can obtain messages typed by the victim on social media or e-mail, and this information can be used to blackmail the victims.”

The campaign appears to be active since May 2022, with a growing number of attacks following the wave of anti government protests began in September.

VPN downloads in Iran skyrocketed following this, reaching a peak of more than 3,000% increase by the end of the month.

A VPN is largely used by Iranian citizens to access restricted apps like Instagram and WhatsApp. But, as the government increasingly charges dissidents with harsh sentences even reaching the death penalty, extra security software is also a necessity to safeguard sensitive data.

While more and more Iranians download a virtual private network on their devices, authorities are hardly cracking down on reliable VPN services as a result.

Many providers are currently blocked in Iran, meaning that third-party VPN installers are increasingly in popularity. According to Iran International (opens in new tab), 20Speed VPN is actually one of the most popular websites where Iranians head to buy their VPN subscriptions. Over 100,000 are the active installations of its Android VPN app.

To fight against such malware campaigns, Bitdefender's experts recommend “using well-known VPN solutions downloaded from legitimate sources. Also, a security solution, like Bitdefender, can protect against information stealers.”