{"id":3780,"date":"2021-02-22T09:18:55","date_gmt":"2021-02-22T08:18:55","guid":{"rendered":"https:\/\/xopero.com\/blog\/?p=3780"},"modified":"2024-05-15T12:00:35","modified_gmt":"2024-05-15T10:00:35","slug":"masslogger-comeback-a-new-and-powerful-variant-steals-outlook-and-chrome-credentials","status":"publish","type":"post","link":"https:\/\/xopero.com\/blog\/en\/masslogger-comeback-a-new-and-powerful-variant-steals-outlook-and-chrome-credentials\/","title":{"rendered":"Masslogger comeback – a new and powerful variant steals Outlook and Chrome credentials"},"content":{"rendered":"\n

MassLogger malware has come back in a new variant which is much more powerful than the old spyware that has attacked the Windows platform for years. (Brand)New and better? Yes. We are dealing with a Trojan horse that tries to steal usernames and passwords from Microsoft Outlook, the Thunderbird email client, and password managers built into Google Chrome, Mozilla Firefox, Microsoft Edge and other browsers. Have you got any suspicious-looking email? Better never open it. Want to find out more about MassLogger? Check the article below for more information.<\/p>\n\n\n\n\n\n\n\n

<\/div>\n\n\n\n<\/a>\n\n\n

Masslogger, cred-stealing trojan harvests logins from Chrome, Outlook and more<\/strong><\/h2>\n\n\n

Cisco Talos researchers warn against Masslogger Trojan being used in attacks designed to steal Microsoft Outlook, Google Chrome, and instant messengers account credentials. The operators have been linked to the use of AgentTesla, Formbook, and AsyncRAT.<\/p>\n\n\n\n

Delivered through phishing emails, the Masslogger trojan\u2019s latest variant is contained within a multi-volume RAR archive using the .chm file format and .r00 extensions, said Switchzilla\u2019s security research arm.<\/p>\n\n\n\n

Opening the \u201chelp\u201d file deploys the malware onto the target system.<\/p>\n\n\n\n

Cisco Talos added: \u201cMasslogger is a credential stealer and keylogger with the ability to exfiltrate data through SMTP, FTP or HTTP protocols. For the first two, no additional server-side components are required, while the exfiltration over HTTP is done through the Masslogger control panel web application.\u201d<\/p>\n\n\n\n

Apps vulnerable to these dastardly cred-stealing doings include Discord, Microsoft Outlook, Mozilla Thunderbird, Firefox and Chromium-based browsers. The malware also tries to exclude itself from Windows Defender scans.<\/p>\n\n\n\n

The second stage of the infection is a PowerShell script, a common technique, that loads the main Masslogger loader from compromised legitimate hosts as a .jpg file. From there the loader is deployed and executed.<\/p>\n\n\n\n

Talos said the malicious folk behind Masslogger were mostly targeting southern and eastern European countries.<\/p>\n\n\n\n

Source: 1<\/a> | 2<\/a><\/p>\n\n\n\n

\"\"<\/a><\/figure><\/div>\n\n\n\n
<\/div>\n\n\n\n<\/a>\n\n\n

Windows and Linux servers targeted by new WatchDog botnet for almost\u2026 two years<\/strong><\/h2>\n\n\n

Cryptocurrency-mining malware, called WatchDog, has been running under the radar for more than two years \u2013 in what researchers call one of the largest and longest-lasting Monero cryptojacking attacks to date. It is clear that the WatchDog operators are skilled coders and have enjoyed a relative lack of attention regarding their mining operations. <\/p>\n\n\n\n

The attack is still in operation and due to the size and scope of the infrastructure, it will be difficult to fully contain. Attackers have hijacked at least 476 Windows and Linux devices, in order to abuse their system resources for mining Monero cryptocurrency. However, researchers estimated the size of the botnet to be around 500 to 1,000 infected systems.<\/p>\n\n\n\n

Right now, the attackers behind this campaign are sticking to cryptojacking. But it is \u201chighly likely\u201d they could find identity and access management (IAM) data on previously-compromised cloud systems, due to the root and administrative access that\u2019s acquired during the malware implantation. This could open the door for future \u2013 and more dangerous \u2013 attacks. On infected servers, WatchDog usually runs with admin privileges and could perform a credentials scan & dump without any difficulty, if its creators ever wished to.<\/p>\n\n\n\n

The point of entry for their attacks has been outdated enterprise apps. According to an analysis of the WatchDog botnet operations published on Wednesday, Unit 42 said the botnet operators used 33 different exploits to target 32 vulnerabilities in software such as:<\/p>\n\n\n\n

Drupal, Elasticsearch, Apache Hadoop, Redis, Spring Data Commons, SQL Server, ThinkPHP, Oracle WebLogic, CCTV.<\/p>\n\n\n\n

Profits were estimated at 209 Monero coins, currently valued at around $32,000, but the real figure is believed to be much higher since researchers only managed to analyze a few binaries, and the WatchDog gang is thought to have used many more Monero addresses to collect their illegal crypto-mining funds.<\/p>\n\n\n\n

How can you protect your system? Let us say it once again and again – keep systems and apps up to date to prevent attacks using exploits for old vulnerabilities.<\/p>\n\n\n\n

Source: 1<\/a> | 2<\/a><\/p>\n\n\n\n

<\/div>\n\n\n\n<\/a>\n\n\n