Phlox Tempest

Executive Summary

Phlox Tempest, also known as DEV-0796, is a threat actor conducting large-scale click fraud campaigns. They use ChromeLoader malware to infect users through malicious YouTube comments and ads, aiming to generate profit from fraudulent ad clicks.

Goals & Targeting

Phlox Tempest targets individuals across various sectors, particularly those in regions with high online advertising activity. Their focus is to maximize ad impressions through infected devices, leading businesses into financial losses and reputational damage due to click fraud.

Phlox Tempest operates a significant click-fraud campaign, exploiting users via malicious Chrome extensions and ISO files. Their primary vector involves distributing these files through compromised YouTube accounts and malicious广告. Infection leads to browser-based malicious activities aimed at generating fraudulent clicks for financial gain. The group's operations have been noted by Microsoft and other cybersecurity firms, highlighting the persistent nature of their campaigns.

Key Capabilities

• Use of ChromeLoader malware
• Social engineering via malicious YouTube comments
• Malicious ISO file distribution

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Phlox Tempest engages in sustained campaigns, leveraging weekends for increased activity. Targets include users globally but with higher focus on regions where online ads are prevalent.

IOC Patterns

• Distribution of malicious ISO files via phishing
• C2 communication via HTTP/HTTPS channels

Recommended Actions

• Implement user education on phishing and suspicious links
• Monitor network traffic for C2 patterns
• Enhance endpoint detection with EDR solutions

Suggested Tags