It is currently unclear who is behind this malware strain however, Trend Micro said it found several clues linking the BIOPASS malware to a group of Chinese state-sponsored hackers known as Winnti or APT41. Per Trend Micro, the attackers use OBS Studio’s RTMP (Real-Time Messaging Protocol) streaming capabilities to record the user’s screen and broadcast it to an attacker’s control panel. Trend Microīut while BIOPASS looks like any other RAT, it also comes with a new feature not seen in any other malware strain-namely, it installs the OBS Studio software on victims’ systems. It also has the ability to compromise the private information of its victims by stealing web browser and instant messaging client data. Those who installed the malicious Flash and Silverlight apps would install a legitimate version of the software, but also the BIOPASS RAT, which granted attackers full control over their systems.īIOPASS RAT possesses basic features found in other malware, such as file system assessment, remote desktop access, file exfiltration, and shell command execution. Named BIOPASS, this malware is a remote access trojan (RAT) coded in Python that was spotted in recent attacks targeting online gambling companies in China.ĭiscovered by security firm Trend Micro, the RAT has been disguised inside legitimate installers for Adobe Flash Player or Microsoft Silverlight, two technologies that are still being used in China, despite reaching EOL (end-of-life).Īccording to a report published last week, malicious JavaScript code planted by attackers on the tech/chat support pages of Chinese gambling-related sites redirected users to pages offering would-be victims tainted installers. Security researchers have uncovered a new malware strain that uses the popular OBS Studio live-streaming app to record and broadcast the screen of its victims to attackers. Links have been found between BIOPASS and a Chinese espionage group known as Winnti/APT41.BIOPASS uses OBS Studio software to broadcast victims' screen to the attackers.Trend Micro discovers new BIOPASS RAT malware in attacks against Chinese gambling site users.

Malware abuses OBS live-streaming software to record victims’ screens

Using obs studio as security