Hackers Bypass 2FA with Info Stealers

Attackers frequently inject scripts to add the C drive to Windows Defender's exclusions, allowing malware to operate undetected. Despite the active malware, Windows Defender displays a green tick, falsely assuring users of their system's security. This method allows malware to run freely, as the antivirus software is no longer scanning critical system areas, giving users a false sense of security.

As a teenager, Leo embarked on early security research, driven by a desire to identify the most effective security solutions. He conducted experiments by running various malware samples against different antivirus tools, including Bitdefender. This hands-on approach, which began as a hobby, evolved into a professional career where he now works with major enterprise vendors, whereas Windows Defender did not exist at the time.

This Windows-only tool provides essential functionalities that allow users to monitor and manage their system processes effectively. Its simplicity makes it accessible even for those new to cybersecurity, offering a foundational understanding of system operations.

The Windows Task Manager provides an incomplete list of startup items, failing to show all running processes. Most modern malware evades detection by operating as hidden services or integrating with legitimate Microsoft processes, making them invisible to the Task Manager. To uncover these hidden threats, tools like Autoruns or checking the services section are necessary, with Autoruns being the recommended starting point for deeper investigation into persistence mechanisms.

Analyzing the output from Autoruns serves as an excellent learning exercise, helping users understand various system processes and potential vulnerabilities. While more advanced diagnostic tools exist, they are not ideal for beginners, making Autoruns and TCP View crucial starting points.

The Global Device ID (GDIP) is globally tied to a specific virtual or physical computer, allowing continuous tracking of online activity regardless of VPN usage. This identifier ensures that even if a connection's apparent origin is spoofed (e.g., from London or Florida), the specific device can still be identified. Telemetry data continuously sends this ID to Microsoft, enabling law enforcement to link social media logins to a particular device, irrespective of the perceived connection location.

Leo acknowledges that he would be a hypocrite if he claimed not to use Windows, as it remains the primary operating system for many businesses and is extensively used in the gaming industry. He notes that Linux has not yet provided a satisfactory replacement for Windows' widespread adoption and functionality. While privacy concerns exist, telemetry data collection in Windows can be mitigated through various service adjustments and system tweaks.

The Global Device ID (GDID) system has demonstrated positive outcomes by enabling the tracking of ransomware operators and, in some cases, assisting victims. Law enforcement has been able to recover cryptographic keys from attackers' servers, allowing victims to decrypt their data for free. This capability has led ransomware authors to shift from simple encryption to data exfiltration models, as stolen and sold data poses a more irreversible threat, making info stealers a preferred method because there is no undoing the theft once data is sold.

The most pervasive method attackers use to gain access to systems is through compromised credentials. Info stealers are currently the dominant method for acquiring these credentials, impacting both home users and corporate environments. This widespread use makes info stealers a critical threat across all sectors.

Cyber attacks function as a business with a sophisticated division of labor, involving specialized roles such as initial access brokers. These brokers acquire credentials and sell access to organizations to bidders who aim to monetize the breach. The price of these credentials varies significantly, depending on the potential financial gain that can be extracted from the targeted organization, highlighting the systematic nature of modern cybercrime.

When a security incident occurs, victims often panic and exacerbate the situation by locking themselves out of their accounts. This reaction, stemming from a lack of understanding of their account landscape, gives hackers more time and opportunity to exploit the compromised systems. A calm, informed response is crucial to mitigating damage during a breach.

Microsoft Defender has significantly improved its detection rates through advanced sandbox and cloud analysis, now offering competitive performance against other vendors. Despite these advancements, new computers frequently come preloaded with what users perceive as bloatware, such as McAfee. Modern free antivirus products, including Avast and McAfee, have also evolved into 'glorified adware,' underscoring the challenge of finding truly effective and unobtrusive security solutions.

This cloud-dependent approach means that threats must be identified and uploaded to the cloud before Defender can detect them, creating a crucial time lag. Hackers actively exploit this limitation by specifically testing and bypassing Defender, leveraging its default status to deploy undetected malware.

To enhance detection capabilities, it is advisable to consider free solutions like Bit Defender, which offer more sophisticated memory detection. Modern malware frequently uses fileless, memory-based execution to bypass standard file scanners, making advanced memory detection crucial. Hackers often neutralize built-in defenses by adding themselves to Defender's exclusions, allowing their malware to run silently, thus necessitating additional security layers.

Malvertising poses a significant risk as malicious sites can appear as top search results on platforms like Google, deceiving unsuspecting users. Hackers frequently create highly convincing look-alike domains that often mimic or even surpass the appearance of legitimate websites. Notable incidents include malware sites spoofing popular software like OBS Studio and 7-Zip, where the fake sites looked superior to their official counterparts.

Hackers often leave a 'time window' of several days or even weeks between stealing data and exploiting it, offering a crucial opportunity for detection. Stolen data is frequently logged via platforms like Discord webhooks, where attackers monitor it before acting. Early detection during this period allows victims to reset passwords, revoke access, and potentially prevent further damage before their credentials are fully compromised.

Relying on a single platform, such as Google or Microsoft suites, creates vendor lock-in, granting these companies significant leverage during negotiations. To maintain control and flexibility, users should strive to separate themselves from specific platforms and manage their own tools and data. Once fully integrated into a walled garden ecosystem, switching platforms becomes significantly more difficult, limiting user options.

Cybersecurity is a pervasive and broad problem that transcends specific operating systems, impacting Microsoft, Linux, macOS, and Android alike. Vulnerabilities are inherent across all computing environments, as evidenced by recent serious kernel-level vulnerabilities found even in Ubuntu. The vast scale of cybercrime underscores that no single platform is immune, affecting all modern digital interactions.