Trickbot trojan gets dangerous as it can now run in stealth mode

. It uses Wsreset.exe , which when executing a command it will not display a UAC prompt and users will have no idea that a program has been executed.


https://www.bleepingcomputer.com/news/security/trickbot-uses-a-new-windows-10-uac-bypass-to-launch-quietly/

Malware evolution - New (sLoad) downloaders can perform reconnaissance and then determine what malware to install

 The new SLoad Banking Trojan downloader gathers information about the infected system, including a list of running processes, the presence of Outlook, and the presence of Citrix-related files. It will also take screenshots of the target machine.


Current targets are banks in Canada, the UK and Italy (this can expand)

https://threatpost.com/sload-banking-trojan-downloader-displays-sophisticated-recon-and-targeting/138542/

Terdot trojan - once infected you may end up with TearDrop(s)

It can target social media networks  including Facebook, Twitter, Google Plus, and YouTube, and email  service providers including Google's Gmail, Microsoft's live.com, and  Yahoo Mail.

It can also bypass restrictions imposed by TLS (Transport Layer Security) by generating its own Certificate Authority (CA) and generating certificates for every domain the victim visits


For More:
https://thehackernews.com/2017/11/facebook-twitter-hack.html

Interesting (and a bit scary) - Red Alert 2.0 (Trojan) can block incoming calls (from my Bank?)

How come the people who make products can't be this smart



Red Alert 2.0 (Trojan) continues to be updated with functionality recently added to block incoming calls from banks, including those which may be from financial fraud departments investigating potential malicious activity.


More here:
https://www.tripwire.com/state-of-security/featured/red-alert-android-banking-trojan/

This is not good - Trojanized Putty Client

From the article:

According to Symantec researchers, an unofficial version of the open-source Secure Shell (SSH) client PuTTY has been discovered in the wild which may compromise the privacy and safety of developers.

The Trojanized PuTTY version was first discovered in 2013, however the researchers believe scanner tests were being performed at this time due to low levels of distribution. However, the file is now being downloaded after users seek a download through Google and inadvertently pick a compromised third-party website to download the program rather than its official source.

The compromised website then redirects the user several times, ultimately connecting them to an IP address in the United Arab Emirates, according to Symantec. The altered version of PuTTY then is downloaded.

Use the link below for more details:

http://www.zdnet.com/article/trojanized-version-of-putty-client-discovered-online/

Pandemiya - New Trojan, New Code, Novel Technique

"This malicious code writer has chosen to use quite a novel technique for injecting its malicious code into every new process in the victim's computer," 

As a part of that injection mechanism, the malware assures its persistence on a system by checking to ensure that Explorer.exe is injected with its code each time a new process is initiated.

The link below has more information:-

http://www.darkreading.com/new-commercialized-trojan-takes-fresh-approach-to-password-stealing/d/d-id/1269550

WATCHOUT - Win32/Spy.Zbot.AAU trojan in fake e-ticket from British Airways

If you have received an unexpected email, claiming to come from British Airways, about an upcoming flight that you haven’t booked – please be on your guard.


Online criminals are attempting to infect innocent users’ computers with a variant of the malicious Win32/Spy.Zbot.AAU trojan, by disguising their attack as an e-ticket from the airline


The link below has more details:

http://www.welivesecurity.com/2014/02/25/british-airways-e-ticket-malware-attack-launched-via-email

Another case of "Malvertisement"

The drive-by-download attack was distributed via adverts shown on the YouTube website, and used an exploit kit to infect Windows PCs with a version of the Caphaw banking Trojan.

Bromium worked with the Google security team over the weekend to resolve the issue on YouTube.

However, it’s quite possible that some users have still had their computers infected by the malware attack, and could be having their banking credentials stolen as a result.

More details are in the link below:
http://labs.bromium.com/2014/02/21/the-wild-wild-web-youtube-ads-serving-malware/