malware – Martijn Grooten

Malware authors' continued use of stolen certificates isn't all bad news

Martijn — Tue, 10 Jul 2018 12:00:55 +0000

A new malware campaign that uses two stolen code-signing certificates shows that such certificates continue to be popular among malware authors. But there is a positive side to malware authors’ use of stolen certificates.
More on Virus Bulletin’s blog.

Necurs update reminds us that the botnet cannot be ignored

Martijn — Fri, 06 Jul 2018 12:00:47 +0000

The operators of the Necurs botnet, best known for being one of the most prolific spam botnets of the past few years, have pushed out updates to its client, which provide some important lessons about why malware infections matter.
More on Virus Bulletin’s blog.

Subtle change could see a reduction in installation of malicious Chrome extensions

Martijn — Wed, 13 Jun 2018 09:37:02 +0000

Google has made a subtle change to its Chrome browser, banning the inline installation of new extensions, thus making it harder for malware authors to trick users into unwittingly installing malicious extensions.
Read more on Virus Bulletin’s blog.

Polish banks targeted by attackers who hijack customer sessions

Martijn — Mon, 04 Jun 2018 09:48:29 +0000

Rather than hooking into the browser process, BackSwap takes the place of the user and enters the same commands into the browser that a user would if they wanted to hack themselves.
Read more on Payment Source. (Note: subscription wall.)

MnuBot banking trojan communicates via SQL server

Martijn — Wed, 30 May 2018 09:34:55 +0000

Researchers at IBM X-Force have discovered MnuBot, a banking trojan targeting users in Brazil, which is noteworthy for using SQL Server for command and control communication.
Read more on Virus Bulletin’s blog.

XMRig used in new macOS cryptominer

Martijn — Wed, 23 May 2018 09:34:35 +0000

A new piece of cryptocurrency-mining malware on macOS has been found to use the popular XMRig miner.
Read more on Virus Bulletin’s blog.

New malware freezes user's device in account takeover scheme

Martijn — Sun, 01 Apr 2018 09:41:05 +0000

The one thing more valuable to consumers than their bank accounts might be their internet access — and a new version of the ‘Trickbot’ trojan targets both.
Read more on Payment Source. (Note: subscription wall.)