A sneaky and persistent malware has made its presence felt in recent days, and owners of computers running Windows 10 are its main target. The malware floods computers with advertisements and takes screenshots of the desktop, which it then sends to the attackers.
Security researchers at Bitdefenderdiscovered this malware called Zacinlo, which first appeared in 2012. About 90% of Zacinlo victims are from the US and are running Microsoft Windows 10 on their PCs. However, there are also other victims in Western Europe, China, and India, while a small percentage of those running Windows 7 and 8 have also been affected.
How does it infect computers?
Zacinlo enters computers via a rootkit that comes bundled with a “free VPN app” that allows it to easily infiltrate the system. Once loaded, the fake app ostensibly acts as a VPN, while in reality it downloads files and transfers the final Zacinlo payload in the background.
The malware exhibits advanced capabilities, such as installing itself on a targeted system and spamming it with ads every time the victim opens a website.
It also replaces legitimate ads on a website with ads developed by the attackers, in order to generate revenue through them. In fact, it can eliminate any other adware already present on the device so that there is no competition.
Most worryingly, Zacinlo can take screenshots of your desktop and send them to attackers, putting sensitive information like login credentials, photos, videos, etc. at risk of falling into the wrong hands.
How can we avoid it?
A fake free VPN called s5Mark has been identified as the carrier of this malware. Zacinlo can run smoothly on popular browsers like Chrome, Firefox, Opera, Safari, Edge, Internet Explorer, etc. and installs payload to hijack secure web connections via MITM attack methods. Thus, researchers advise Windows users to avoid installing unknown or suspicious third-party applications and not visit unknown websites.
