Malwarebytes Labs researchers uncovered multiple campaigns distributing an infostealer we track as NWHStealer, using everything from fake VPN downloads to hardware utilities and gaming mods.
What makes this campaign stand out isn’t just the malware, but how widely and convincingly it’s being spread. Once installed, it can collect browser data, saved passwords, and cryptocurrency wallet information, which attackers may use to access accounts, steal funds, or carry out further attacks. We detected multiple campaigns using different platforms and lures to distribute NWHStealer. The stealer is loaded and executed in several ways, such as self-injection or injection into other processes like RegAsm (Microsoft’s Assembly Registration Tool). Often, additional wrappers such as MSI or Node.js are used as the initial loader.
Read more…
Source: Malwarebytes Labs
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- Fancy Bear Hackers Target French Presidential Candidate
April 25, 2017
A phishing campaign is targeting the emails of French presidential candidate Emmanuel Macron’s campaign staff. All fingers are pointing towards Russia once more. According to security firm Trend Micro who published a new report today, there are signs of a phishing attack targeting Macron, in what feels like deja-vu. The sites that are trying to trick ...
- Hard Target: Fileless Malware
April 25, 2017
The future of client-side malware attacks is fileless. And it would appear the future has arrived with a growing number of attacks using fileless or in-memory malware to pose a threat to business that’s increasingly difficult to neutralize. “There has been an unequivocal uptick in the use of fileless malware as a threat vector,” said Kevin Epstein, ...
- Fortinet Supports INTERPOL-led Cybercrime Operation across the Association of Southeast Asian Nations (ASEAN)
April 24, 2017
Fortinet has partnered with INTERPOL over the past two years to assist in identifying and thwarting cybercrime. Today, INTERPOL announced that a new operation across the ASEAN region, built around threat intelligence provided by Fortinet and other public and private sector security organizations, has resulted in the identification of nearly 9,000 Command and Control (C2) ...
- US Court Sentences Russian Lawmaker’s Son to 27 Years in Jail for Hacking
April 21, 2017
The son of a prominent Russian lawmaker was sentenced on Friday by a US federal court to 27 years in prison after being convicted of stealing millions of US credit card numbers and causing some $170 million in damages to businesses and individuals. This sentence is so far the longest sentence ever imposed in the United ...
- Improved cyber security for General Election after Russian hacking scandal
April 21, 2017
Cyber security chiefs are to give fresh guidance to protect the general election from being disrupted by hackers. Just weeks ago, Ciaran Martin, chief executive of the National Cyber Security Centre, briefed political party bosses on how they can defend their organisations from online attacks. They were given an overview of threats, case studies on recent cyber ...
- Hong Kong to tighten cyber security rules after broker hacks
April 20, 2017
Hong Kong plans to toughen information security rules after a series of embarrassing hacks at the city’s brokers, the securities regulator said on Thursday. The draft rules would likely include requirements for two-step authentication for account log-in and for brokers to notify clients when a transaction had been made, a Hong Kong Securities and Futures Commission ...