Hackers posed as Amnesty International, promising anti-spyware tool that actually collects passwords

guest · Sep 30, 2021

Hackers posed as Amnesty International, promising anti-spyware tool that actually collects passwords
September 30, 2021
https://www.cyberscoop.com/amnesty-international-spyware-scam-pegasus/

Fraudsters are posing as human rights group Amnesty International to trick individuals into downloading malicious software, researchers at Cisco’s threat intelligence unit Talos report.

Masquerading as the human rights group, hackers registered multiple domains using variations on the Amnesty name to advertise a demo for “Amnesty Anti Pegasus” software that could allegedly scan devices for the NSO Group spyware, which Amnesty has closely examined. The malware had a realistic-looking “Anti Pegasus” user interface. In fact, victims downloaded Sarwent, a malicious software that gives attackers a backdoor to a victim’s machine.
Click to expand...

Hackers can use that access to download and execute other malicious tools as well as exfiltrate data such as passwords.
What’s still unclear is how the group is spreading the fake domains.

A spokesperson for Talos said the security firm has reported its findings to Amnesty. CyberScoop reached out to Amnesty International for comment.
Click to expand...

Cisco Talos: A wolf in sheep's clothing: Actors spread malware by leveraging trust in Amnesty International and fear of Pegasus

At first glance, it may seem like an actor trying to gather some easy-to-monetize information. However, there are aspects of this, such as the level of customization with the RAT, information that appears to be intentionally misleading and the low volume of targets, that indicate this may be a more advanced actor without a financial motivation.

This is just the latest example of a threat actor trying to capitalize on people's concerns for their safety and recent headlines
Click to expand...

Log in or Sign up

Hackers posed as Amnesty International, promising anti-spyware tool that actually collects passwords

guest Guest

Log in or Sign up

Hackers posed as Amnesty International, promising anti-spyware tool that actually collects passwords

guest Guest

Useful Searches