Linksys and D-Link routers targeted by new malware: here's how to stay safe

Linksys and D-Link routers targeted by new malware: here's how to stay safe

Hackers are targeting several popular router brands in an attempt to hack devices and gain access to home networks. Bitdefender's investigation found that criminals hack devices and change DNS settings to display browser alerts prompting users to download fake coronavirus information apps. D-Link and Linksys routers are the most affected, with hackers using a brute force attack to gain access to the router's admin panel. Once there, the hackers change your DNS settings to direct web traffic to their servers.

Router hijacking

Once the router is hijacked using specific IP addresses, the routers share the user's browsing information with the hackers' servers. Hackers also use a predefined list of websites that, when visited, are automatically redirected to another site to trick users into downloading the fake Covid-19 app, purportedly from the World Health Organization (WHO). Domains that have been used to redirect users to the fake website are: According to researchers, the rogue application installs a version of the data-stealing Trojan Oski. This recently discovered malware was found to be commonly sold on Russian dark web forums, and is primarily used to steal credentials, browser cookies, payment information, a 2FA authentication database, saved login information, and information about wallets from cryptocurrencies. Once the information collected through the router has been accessed by hackers, it can be used for a variety of purposes, such as hacking into users' encrypted wallets to steal their cryptocurrency, using details to perform identity theft, or performing other phishing attacks. Some users have reported that their settings may have been compromised due to weak passwords or they may have left remote access enabled. Bitdefender advises users with a D-link or Linksys router to ensure that they are using a strong password and that the router settings are correct as per their ISP's instructions.

You might also be interested ...