Spyware found stealing Iranian user data via infected VPN installer

Spyware has been discovered stealing Iranian users data via an infected VPN installer, antivirus provider Bitdefender has revealed. 

The company’s joint-research with cybersecurity firm Blackpoint found components of Iranian-made EyeSpy malware to be injected “through Trojanized installers of VPN software (also developed in Iran).”  

The majority of targets were within the country’s borders, only a few victims were found to be based in Germany and the US. 

This is particularly concerning in a country like Iran, where using one the best VPN services has increasingly become a necessity. Whether this is for bypassing its strict online censorship, or preserving anonymity to avoid dangerous government surveillance. Most likely, a mix of both.  

At the same time, a harsh crackdown on Iranian VPN services might push people towards unsecure third-party vendor sites. This makes such a spyware campaign even more dangerous for Iranians’ privacy and security.    

Anti-dissident spware?

“In light of the recent events, it’s possible that the targets are Iranians who want to access the internet via a VPN to bypass the country’s digital lockdown. Such malicious installers could plant spyware on people who pose a threat to the regime,” Bitdefender’s report (opens in new tab) noted. 

Developed by Iranian-based firm SecondEye, EyeSpy is a legit monitoring software sold to businesses as a way to monitor employees’ activities working remotely.  

The attackers were observed using components of the legit application in a malicious way to infect users’ downloading the Iranian-based VPN service 20Speed and spy on their activities.     

Once injected into a device, the malware can virtually spy on every activity and collect a tons of sensitive data. These include stored passwords, crypto-wallet data, documents and images, contents from clipboard, and logs key presses. 

“The components of the malware are scripts that steal sensitive information from the system and upload them to an FTP server belonging to SecondEye,” Bitdefender explained.