Cybercriminals are spreading a frightening new variant of malware through email attachments and VPN download links.
Security specialists at Google have raised concerns about a new and perilous malware threat known as Playfulghost, which is being disseminated globally through deceptive VPN applications. According to the researchers, this scam employs advanced tactics, including a method referred to as "SEO poisoning," to lure unsuspecting users into downloading compromised VPN software.
What makes this latest cyberattack especially cruel is that signing-up for one of the best VPN deals is usually a surefire way to strengthen your online security and privacy. But those unlucky enough to install the fake VPN applications laced with malware now find themselves in the worst possible situation.
View pictures in App save up to 80% data.
Playfulghost allows hackers to monitor every letter typed on your keyboard, a technique known as "keylogging", record audio from the built-in microphone on your laptop, tablet, or desktop PC. It can also be used to record what's happening on-screen — a key component in blackmail scams.
The hazardous malware allows cybercriminals to remotely carry out a range of file management tasks, such as opening, deleting, and creating new files. This capability gives hackers the opportunity to download and install additional malware on systems compromised by Playfulghost.
Notably, Playfulghost operates similarly to Gh0st RAT, a remote administration tool that caused significant disruption to computers from 2001 onward, with its source code released to the public in 2008. This accessible code has led to the creation of various clones and imitations, including the most recent version.
According to Google, the malware was detected due to its "unique traffic patterns and encryption techniques."
Security experts at Google have discovered two methods used by cybercriminals to distribute the malware.
To start with, scammers are employing phishing emails—unrequested messages designed to deceive individuals into downloading harmful viruses and malware. The Google team has identified instances where emails with subjects such as “Code of Conduct” are used to lure users into downloading an attached file, which is actually the malicious Playfulghost malware.
In a separate recorded incident, an individual was deceived into opening a compromised image file, which subsequently launched Playfulghost from a remote server secretly on their device.
Another method of spreading the malware includes packaging it with widely-used VPN applications through a technique called SEO poisoning, which alters search engine outcomes to give the impression that harmful downloads are trustworthy.
According to a blog post penned by Google security experts: "The malware is bundled with popular applications, like LetsVPN, and distributed through SEO poisoning. This involves manipulating search engine results to make the bundled software appear at the top of searches, making it seem like a legitimate download."
The exact number of individuals affected by the recent malware attack globally remains uncertain.
However, the rise of Playfulghost coincides with a period when countless individuals around the globe are seeking VPN services to safeguard their online privacy and circumvent geographical limitations.
According to data from vpnMentor, there was an astonishing 1,150% increase in searches for Virtual Private Networks (VPNs) just hours after the implementation of new age-verification laws in Florida, USA.
The recently enacted age-verification law, referred to as House Bill 3 (HB 3), took effect on January 1, 2025.
This legislation imposes major limitations designed to safeguard minors from detrimental online material, especially on social media sites and adult content platforms. The law prohibits children younger than 14 from establishing or utilizing social media profiles, such as those on TikTok and Instagram.
Individuals between the ages of 14 and 15 must obtain parental consent to create an account. Social media platforms are required to remove accounts of users younger than 14 and to enforce these age limitations effectively.
Websites that provide adult content are required to establish age verification measures. This should include the possibility of "anonymous age verification," which must be carried out by an external service that does not keep any personal data once the verification is complete.
Violations of this strict new law can result in civil penalties of up to $50,000 per infraction. Ouch.
In addition to enhancing privacy, VPNs also allow users to disguise their location by manually altering their IP address.
If you're residing in Florida, changing your IP address to reflect a location in a different US state or even another country could allow you to bypass the regulations set forth by House Bill 3.
The significant increase in VPN searches across Florida has fostered a perfect setting for cybercriminals to exploit Playfulghost by manipulating search results.
Security experts warn that as more people hunt for a cheap VPN deal to circumvent geographical restrictions, the risk of encountering SEO-poisoned results containing Playfulghost continues to grow.
View pictures in App save up to 80% data.
What are your capabilities?
Security professionals consistently advise users to evaluate new applications carefully prior to downloading. It's important to look out for signs such as poor grammar in app descriptions and a lack of user reviews on platforms such as the Google Play Store, Apple App Store, and Chrome Web Store.
RECENT UPDATES
McAfee, a security company, recommends that users steer clear of applications that necessitate accessibility services unless it is truly essential. Additionally, if you observe any unusual activity on your laptop, desktop computer, tablet, or smartphone, be sure to review any unfamiliar applications.
Using a malware removal tool to scan your device can assist in identifying concealed dangers. Additionally, it's wise to revoke permissions from any services or applications that you do not recognize.
In a bid to stymie the spread of Playfulghost, users are being urged to only download VPN applications directly from providers' official websites rather than through search engine results to ensure legitimacy.
