New Malware Says Is Name: Nodersok

Nodersok is the new threat of the users, although there would be a solution to stop its expansion. 

This new malware  downloads and installs a copy of the Node.js framework on our computer , which converts infected systems into proxy servers used by their creators for fraud. According to Cisco, those responsible for this new threat seek to monetize their infections through click fraud .

The so-called click fraud or click payment fraud is the practice of artificially inflating traffic statistics to defraud advertisers or websites that provide spaces for advertisers and pay based on the number of clicks on a given link.

To get these figures inflated, hackers are infecting thousands of computers. The technique used requires users to find and execute HTA files , an HTML application. From there, the infection begins in several stages involving Excel, JavaScript and PowerShell scripts to install Nodersok malware on the system.

Despite having infected thousands of machines, Microsoft says its Windows Defender program should be able to detect the attack. However, within the HTA files that install the malware there is  a PowerShell module, which seeks to disable Windows Defender and Windows Update .

Therefore, Cisco experts advise against running any HTA file that we find on computers, especially if we don't know the exact origin of that file. According to Cisco, the malware would still be in development and its authors are still active taking advantage of the thousands of computers that are affected, so the attack could last for quite some time.

Finally, there would be an additional danger, the malware being active, the creators of Nodersok could implement other modules to perform additional tasks , or even implement secondary loads of malware such as ransomware or banking Trojans, without the user being able to do anything to avoid it.

Source:  More info