{
  "family": "socelars",
  "sample_count": 159,
  "category": "infostealer",
  "description": "Trojan:Win32/Socelars is a deceptive trojan family frequently distributed via aggressive social engineering campaigns on major social networks (like Facebook and Twitter) to harvest credentials and distribute secondary payloads.<br><br><b>Understanding Socelars</b><br>To the end-user, Socelars is often the result of clicking a sensationalized news article or a 'shocking video' link posted by a compromised friend's account. For security analysts, Socelars represents a highly effective, low-technical-barrier threat. It relies entirely on manipulating human curiosity rather than exploiting software vulnerabilities, bypassing many perimeter defenses by tricking the user into willingly executing the malware.<br><br><b>Execution and Evasion Strategies</b><br>The infection chain begins on social media. The user clicks a malicious link and is redirected to a fake landing page (e.g., a fake YouTube player). To 'view the video,' the user is prompted to download a 'codec' or 'Flash update'. When the user executes this file (the Socelars dropper), it immediately drops a credential stealer or adware payload into the <code>%AppData%</code> directory. It establishes persistence via Registry Run keys. Crucially, Socelars often steals the user's active social media session tokens (cookies) to immediately post the same malicious links from the victim's account, propagating the worm-like campaign.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is credential theft, compromised social media accounts, and the installation of secondary adware/botnet payloads. Incident responders should monitor for anomalous HTTP traffic to newly registered domains associated with the fake video pages. EDR tools will flag the execution of the fake 'codec' installer from the user's Downloads folder.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1555",
    "T1204.001",
    "T1547.001",
    "T1204.002",
    "T1534"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1204.001",
      "name": "User Execution: Malicious Link",
      "tactic": "Execution"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    },
    {
      "id": "T1555",
      "name": "Credentials from Password Stores",
      "tactic": "Credential Access"
    },
    {
      "id": "T1534",
      "name": "Internal Spearphishing",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint to prevent the downloading of secondary payloads and the active exfiltration of browser cookies.",
    "Force a global password reset for the user's corporate accounts and advise them to immediately reset all personal social media passwords.",
    "Instruct the user to log into their social media accounts from a clean device and revoke any unauthorized third-party application authorizations.",
    "Perform a full EDR sweep to locate the initial Socelars dropper and any secondary adware or stealers it managed to install."
  ],
  "what_to_avoid": [
    "Do not assume the endpoint is secure just because the initial fake 'codec' file was deleted; secondary payloads are likely already active.",
    "Avoid ignoring the social engineering aspect; use the incident as an opportunity to reinforce corporate security awareness training."
  ],
  "target_industries": [
    "Financial Services",
    "Retail",
    "Consumers"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}