Banking Malware Takes Aim at Brazilians

Two malware distribution campaigns are sending banking Trojans to customers of financial institutions in Brazil.

Two ongoing malware distribution campaigns are sending banking Trojans to customers of Brazilian financial institutions, report Cisco Talos researchers, who also identified a spam botnet delivering malicious emails as part of the infection process.
Two separate infection processes were used in these campaigns between late October and early November, they say. The campaigns use different file types for the download and infection processes, but both target Brazilian firms. Researchers believe the attacker is from South America, where it would be easiest to use victims credentials to carry out fraud.
Both campaigns eventually deliver banking Trojans. Researchers also found additional tools and malware – a remote administration tool with the ability to create emails – hosted in an Amazon S3 bucket. The emails, which are created on the BOL Online email platform, suggest the attackers primary goal is to create a botnet of systems specifically for email creation.
More than 700 compromised systems were identified on the servers that are members of the botnet, the researchers report. Overall, the botnet created more than 4,000 unique emails using the BOL Online service; some of them were used to launch the spam campaigns they analyzed.
Talos identified two payloads deployed during the campaigns. The first, also
detected
by FireEye, collects information on the target machine and exfiltrates it to a C2 server. It also includes a keylogger. The second has the same features but is implemented differently; it primarily targets two-factor authentication by showing users fake pop-ups.
Read more details
here
.

Black Hat Europe returns to London Dec 3-6 2018 with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the
conference
and
to register.

Last News
▸ Nigerian scammers now turning into mediocre malware pushers. ◂ Discovered: 23/12/2024 Category: security	▸ Beware EMV may not fully protect against skilled thieves. ◂ Discovered: 23/12/2024 Category: security	▸ Hack Your Hotel Room ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Banking Malware Takes Aim at Brazilians