New AZORult Campaign Abuses Popular VPN Service to Steal Cryptocurrency

guest · Feb 18, 2020

New AZORult Campaign Abuses Popular VPN Service to Steal Cryptocurrency
February 18, 2020
https://www.albawaba.com/business/p...ular-vpn-service-steal-cryptocurrency-1339894

Kaspersky researchers have detected an unusual malicious campaign that uses a phishing copy of a popular VPN service’s website to spread AZORult, a Trojan stealer, under the guise of installers for Windows.

The campaign, which kicked off at the end of November 2019 with the registration of a fake website, is currently active and focused on stealing personal information and cryptocurrency from infected users. This shows that cybercriminals are still hunting for cryptocurrency, despite reports that interest in the currency has died down.
AZORult is one of the most commonly bought and sold stealers on Russian forums due to its wide range of capabilities.
Click to expand...

The victim visits the phishing website and is prompted to download a free VPN installer. Once a victim downloads a fake VPN installer for Windows, it drops a copy of AZORult botnet implant. As soon as the implant is ran, it collects the infected device's environment information and reports it to the server.

Finally, the attacker steals cryptocurrency from locally available wallets (Electrum, Bitcoin, Etherium, and others), FTP logins, and its passwords from FileZilla, email credentials, information from locally installed browsers (including cookies), credentials from WinSCP,Pidgin messenger and others.
Click to expand...

Kaspersky: AZORult spreads as a fake ProtonVPN installer

We have found that at least one of the infection vectors is through affiliation banners networks (Malvertising).
Click to expand...

Log in or Sign up

New AZORult Campaign Abuses Popular VPN Service to Steal Cryptocurrency

guest Guest

Log in or Sign up

New AZORult Campaign Abuses Popular VPN Service to Steal Cryptocurrency

guest Guest

Useful Searches