FlagThis

A new variant of the Snake Keylogger malware is actively targeting Windows users, with over 280 million infection attempts detected globally. Cybersecurity researchers have identified this version, also known as the 404 Keylogger, as AutoIt/Injector.GTY!tr. The primary targets include users in China, Turkey, Indonesia, Taiwan, and Spain, where the malware spreads through phishing emails containing malicious attachments or links. The keylogger steals credentials from popular web browsers like Chrome, Edge, and Firefox by logging keystrokes, capturing screenshots, and monitoring the clipboard.

The stolen data, including sensitive information and credentials, is then exfiltrated to its command-and-control (C2) server through various methods, including SMTP email and Telegram bots. The malware utilizes AutoIt, a scripting language frequently used for Windows automation, to deliver and execute its malicious payload. By using AutoIt, the malware can create standalone executables that may bypass standard antivirus solutions. Once executed, the keylogger copies itself to the %Local_AppData%\supergroup folder, names itself ageless[.]exe, and sets its attributes to hidden and creates “ageless.vbs” in the %Startup% folder.

ImgSrc: www.pcworld.com

References:

• CyberInsider - New Snake Keylogger Variant Launches 280 Million Attacks - 2d
• hackread.com - New Snake Keylogger Variant Hits Windows, Steals Data via Telegram Bots - 2d
• cyberinsider.com - New Snake Keylogger Variant Launches 280 Million Attacks - 2d
• The Register - Software: OSes - Snake Keylogger slithers into Windows, evades detection with AutoIt-compiled payload - 2d
• Talkback Resources - Snake Keylogger Variant Hits Windows, Steals Data via Telegram Bots [net] [mal] - 2d
• The Hacker News - New Snake Keylogger Variant Leverages AutoIt Scripting to Evade Detection - 2d
• PCWorld - This high-risk keylogger malware is a growing threat to Windows users - 2d
• Talkback Resources - New Snake Keylogger infects Windows using AutoIt freeware [mal] - 1d
• SCM feed for Threat Management - More advanced Snake Keylogger variant emerges - 1d
• Talkback Resources - New Snake Keylogger infects Windows using AutoIt freeware [mal] - 1d

Classification:

• HashTags: SnakeKeylogger Malware Phishing
• Company: Snake
• Target: Windows users
• Attacker: Fortinet
• Product: Windows
• Feature: credential stealing
• Type: Malware
• Severity: Major