New Phoenix Keylogger tries to stop over 80 security products to avoid detection

guest · Nov 20, 2019

New Phoenix Keylogger tries to stop over 80 security products to avoid detection
Phoenix linked to more than 10,000 infections since the malware's launch on a hacking forum in July
November 20, 2019
https://www.zdnet.com/article/new-p...over-80-security-products-to-avoid-detection/

A new keylogger called Phoenix that started selling on hacking forums over the summer has now been linked to more than 10,000 infections, researchers from Cybereason said today in a report.
New malware distribution campaigns are being spotted every few weeks, according to threat intelligence shared on Twitter.
MORE OF AN INFOSTEALER THAN KEYLOGGER
While initial versions included the ability to log keystrokes, newer versions come with the ability to dump user data, such as passwords, from 20 different browsers, four different mail clients, FTP clients, and chat applications, researchers said.
The list of security-related process names is listed in the image below [...] blog post by cyber-security company Cyberbit.

Since this data can be extracted within seconds after the initial infection, this also explains why the cybercriminal groups spreading Phoenix rarely bother with configuring a boot persistence method.
The lack of this boot persistence system also makes tracking Phoenix malware infections nigh impossible without extended logging capabilities, usually found in enterprise environments only.
Click to expand...

Log in or Sign up

New Phoenix Keylogger tries to stop over 80 security products to avoid detection

guest Guest

Log in or Sign up

New Phoenix Keylogger tries to stop over 80 security products to avoid detection

guest Guest

Useful Searches