The Mekotio banking trojan is a sophisticated piece of malware that has been active since at least 2015, primarily targeting Latin American countries with the goal of stealing sensitive information — particularly banking credentials — from its targets.
Originating in the Latin American region, it has been particularly prolific in Brazil, Chile, Mexico, Spain, and Peru. Furthermore, Mekotio seems to share a common origin with other notable Latin American banking malware such as Grandoreiro, which was disrupted by law enforcement earlier this year. Mekotio is often delivered through phishing emails, employing social engineering to trick users into interacting with malicious links or attachments. Trend Micro recently seen a surge in attacks involving Mekotio among their customers.
Read more…
Source: Trend Micro
Related:
- Cyber attack on Bulgarian government websites traced to Russia
October 16, 2022
The head of Bulgaria’s National Investigation Service, Borislav Sarafov, said on October 16 that the perpetrator of a cyber attack the previous day on several Bulgarian state, government and private websites had been identified, and the attack had come from a city in Russia. Sarafov told Bulgarian media that the name and address of the perpetrator ...
- How Wi-Fi spy drones snooped on financial firm
October 12, 2022
Modified off-the-shelf drones have been found carrying wireless network-intrusion kit in a very unlikely place. The idea of using consumer-oriented drones for hacking has been explored over the past decade at security conferences like Black Hat 2016, in both the US and in Europe. Naomi Wu, a DIY tech enthusiast, demonstrated a related project called Screaming ...
- Upgraded Prilex Point-of-Sale malware bypasses credit card security
September 29, 2022
Security analysts have observed three new versions of Prilex PoS-targeting malware this year, indicating that its authors and operators are back in action. Prilex started as ATM-focused malware in 2014 and it pivoted to PoS (point of sale) devices in 2016. While development and distribution peaked in 2020, the malware disappeared in 2021. Kaspersky analysts now report ...
- Prilex: the pricey prickle credit card complex
September 28, 2022
Prilex is a Brazilian threat actor that has evolved out of ATM-focused malware into modular point-of-sale malware. The group was behind one of the largest attacks on ATMs in the country, infecting and jackpotting more than 1,000 machines, while also cloning in excess of 28,000 credit cards that were used in these ATMs before the ...
- Ukrainian hackers attacked the Mir payment system
September 24, 2022
Hackers staged a powerful and large-scale DDoS attack on the national payment system “Mir” against the backdrop of news about the possible refusal of a number of countries to work with it. How informs “Kommersant”, the goal is to overload the system so that malfunctions in the work of “Mir” begin. The publication refers to ...
- Rewards plus: Fake mobile banking rewards apps lure users to install info-stealing RAT on Android devices
September 21, 2022
Microsoft analysis of a recent version of a previously reported info-stealing Android malware, delivered through an ongoing SMS campaign, demonstrates the continuous evolution of mobile threats. Masquerading as a banking rewards app, this new version has additional remote access trojan (RAT) capabilities, is more obfuscated, and is currently being used to target customers of Indian ...