SSNC page installs infostealer malware to Firefox clients; likely compromised by hackers

[M1CR0H4CK3R]

See my post on GBAtemp here for the details:
https://gbatemp.net/threads/popular-switch-serial-checker-website-damota-me-infected-with-infostealer-malware.681937/

The SSNC page sets up a rogue command line shortcut that silently opens infostealer domains on startup of the browser. I caught it right before I restarted Firefox yesterday, so I was fortunately spared from the opening of the malware domains themselves, so nothing was stolen.

It is quite likely that your systems were compromised by hackers, possibly even your GitHub itself, and I highly suggest logging out on ALL devices and reverting both all your repositories and your website to a backup from at least 3 months ago, then scanning your website for malware, just to be safe.

[AkdM]

Thanks for reporting this. That is very weird. I am going to check is going on.

I did not setup this. And this is weird as it is static website…

ETA: I am trying to reproduce.

[AkdM]

So, I want to be transparent about what I checked.

I tried multiple ways to reproduce, but I couldn't:

• macOS: Safari, Chromium, Edge.
• Windows 11 (ARM, on a VM as I don't have access to other Windows PC): Edge, Firefox.

I also checked:

• My GitHub account and the GitHub repository (static site built with Astro): no unauthorized access, and no commits I cannot identify (I sign all my commits with my PGP key).
• Cloudflare (DNS, Workers, Rules, account audit log): no unauthorized access or weird API activity. I also use Zaraz for analytics. I double-checked and nothing has been compromised there either (only a Google Analytics v4 tool is configured, no custom HTML or unknown components).
• No Google AdSense warnings or policy errors on the configuration.
• Google Search Console: no flags whatsoever.

I want to clarify a technical point that I think is important here: a static website served over HTTPS cannot by itself write an executable to AppData\Roaming\Mozilla\Extensions\. Browser sandboxing prevents any page (including mine) from creating files on disk, modifying the Firefox profile, or installing extensions silently. For an .exe to end up at that path, a file had to be downloaded and executed at some point on the affected machine, a static page in Firefox cannot make that happen on its own. The fact it ended up into the Extensions folder most likely means you are potentially affected by a comprised extension, and extensions can do a lot more than a regular webpage.

So… the potential sources of the issue:

• Pre-existing malware on your machine that names its dropper after the last-visited domain. This is a very common tactic, specifically designed to frame random and most likely innocent websites.
• As I said, a malicious or hijacked browser extension that activates download prompts based on browsing context. The site you happened to be on at the time is incidental I guess,
• A typosquat or lookalike domain. It is actually possible (but very unlikely) the actual page visited was something like damotа.me (cyrillic а), a fake search ad result, etc... Worth double-checking the URL bar history if you can (please do tell so I can investigate more)
• Maybe a MITM?

To actually get to the bottom of this rather than guesses, the most useful thing would be evidence from you. If could you share:

• If you still have the .exe:
  • The .exe sample itself, zipped uploaded to VirusTotal or any.run, then give the url of the report,
  • A screenshot of the file's Properties: right click -> Properties -> Details tab (the "target box" you mentioned) and the Digital Signatures tab.

Also:

• The exact URL you had open when it appeared, and an approximate timestamp (so I can correlate with my analytics and ad logs)

I really appreciate you flagging this, even if I am mostly confident the source isn't on my side, I'd rather chase it down than leave any uncertainty for other users.

Looking forward to your reply @M1CR0H4CK3R

[AkdM]

Bump @M1CR0H4CK3R