Threat actors have been observed concealing malicious code in images to deliver malware, such as VIP Keylogger and 0bj3ctivity Stealer, as part of separate campaigns. In both campaigns, attackers hid malicious code in photos uploaded to archive[.]org, a file-hosting website, and used the same .NET loader to install their final payloads. The starting point is a phishing email that masquerades as invoices and purchase orders to trick recipients into opening malicious attachments, such as Microsoft
404 keylogger (2)
FortiGuard Labs recently caught a phishing campaign with a malicious Excel document attached to the phishing email. Analysts performed a deep analysis on the campaign and discovered that it delivers a new variant of Snake Keylogger. Snake Keylogger (aka “404 Keylogger” or “KrakenKeylogger”) is a subscription-based keylogger with many capabilities. It is a .NET-based software originally sold on a hacker forum. Once executed on a victim’s computer, it can steal sensitive data, including saved
