The threat intelligence team at Cisco Talos has discovered a new trojan campaign that can steal personal credentials from web browsers (opens in new tab), Microsoft Outlook (opens in new tab), and instant messaging apps. The attack method starts with a phishing email containing a malicious HTML file attachment.
“The employs a multi-modular approach that starts with the initial phishing email and carries through to the final payload,” Vanja Svajcer, an outreach researcher woractor king for Cisco Talos, explained (opens in new tab). “The adversaries behind this campaign likely do this to evade detection. But it can also be a weakness, as there are plenty of opportunities for defenders to break the killchain.”
- We've highlighted the best antivirus (opens in new tab) solutions around
- Check out our roundup of the best ransomware protection (opens in new tab) tools out there
- Keep your devices virus-free with the best malware removal (opens in new tab) software
We meet again
The type of trojan used in this campaign is known as “Masslogger” and it has been seen in the wild before. Masslogger was first released in April 2020 and sold on underground forums as a way of stealing credentials, mostly from browsers but also from email clients (opens in new tab) and messaging apps (opens in new tab).
For this campaign, it seems that the threat actor or group involved had specific targets in mind or at least a particular region that they felt comfortable targeting – primarily eastern and southern Europe. Cisco Talos identified email messages targeting Latvia, Lithuania, Turkey, Bulgaria, Estonia, Romania, Hungary, Italy, and Spain, with some messaged written in English.
To block this exploit, individuals should conduct regular and background memory scans, employ up-to-date web and email security (opens in new tab) solutions and remain vigilant against suspicious-looking emails.
- We've also put together a list of the best endpoint protection (opens in new tab) software
Via The Register (opens in new tab)