The Trojan TrickBot attacks PayPal users and CRM systems

Security researchers reported a jump in attacks by using the TrickBot bank trio. If before cyber criminals were limited to online banking applications, they are now targeting users of PayPal and CRM-business systems.

TrickBot - a relatively new malware that appeared in September 2016. Unofficially, it is considered that the malware is successor of the bank Trojan Dyre, who disappeared from the cybercrime scene in the winter of 2015-2016 after a search in one of the Russian companies. Now, however, the Trojan has not simply changed from the Dyre version. With the release of the original version, its creators are regularly updating and refining their product, and soon TrickBot will receive support for a larger number of fake authoring pages, allowing the hijacking of user data from different countries. In particular, pages have been added to authorize the 35 PayPal URLs.

Originally, TrickBot was used only for attacks by Australian users, but in April 2017 it was also used to attack banks in the US, UK, Germany, Ireland, Canada, New Zealand, Switzerland and France. In recent campaigns, the Trojan has also attacked consumers in the Netherlands, Singapore, India and Bulgaria.

In June, experts from F5 Networks, PhishMe, and PwC, as well as researcher Brad Duncan, recorded a rapid increase in attacks by using the Trojan horse. If his share was 1% of open attacks a month ago, in June this percentage increased to 3%.

Harmful software is spreading through spamming emails. Phishing emails contain a PDF file, forcing the victim to open a Word document and see its content, which actually activates macros.

*** Don't miss out on my next post! Follow me @bachoangel ***