Threats Tagged 'keylogger'

A fraudulent version of the widely-used PC cleaning utility CCleaner is being distributed through a convincing imitation website to deploy GhostDesk, a malicious Chrome extension functioning as spyware. The attack begins when users download the fake application from a lookalike site, which then launches a multi-stage infection using CScript to modify Chrome's Security Extension and install malicious components. Once active, GhostDesk performs extensive surveillance including credential theft, keylogging, screenshot capture, cookie harvesting, and cryptojacking. The extension establishes command-and-control communications via WebSocket connections and can execute arbitrary code within browser tabs. Similar fake versions of other popular software like 7-Zip and Adobe Acrobat have been identified using identical infection techniques.

The Larva-24009 threat actor, also known as HeptaX, has been conducting phishing email campaigns since 2023 targeting enterprises globally. The attacker uses LNK files disguised as documents to deliver malware that executes obfuscated PowerShell commands, deploying backdoors and downloading additional scripts. Persistence is established via Windows Task Scheduler, and remote access is enabled through QuasarRAT and UltraVNC. The actor steals information using NirSoft tools, custom keyloggers, and screenshot utilities, creates backdoor RDP accounts, and exfiltrates credentials, browser data, and user files. Their Notifier malware version 2.1 uses the Telegram API for status reporting. The campaigns demonstrate consistent tactics and infrastructure over multiple years.