Security researchers have discovered a trojan malwarethat has appeared before. This time, the trojan is being distributed via phishing emails. The emails claim that a payment to a bank account.
It is the Remcos Trojan, which allows remote access. The Trojan first appeared in 2016 on underground forums. Since then, it has received several updates and evolved. Hackers can obtain it for just $58.
Remcos Trojan is suitable for stealing information and monitoring victims. It has many capabilities: keylogging, taking screenshots, stealing clipboard content. In this way, the malware gains access to the victim's username and password.
The current phishing campaign, which distributes the Remcos Trojan, was discovered by researchers . The new variant is called “2.5.0 Pro.” Some changes have been made to the code, indicating its evolution.
Hackers send phishing emails and trick the victiminto opening a malicious ZIP file. The file is supposedly related to a payment to a bank account.
The .ZIP file is actually a gateway to a .TXT extension, which executes a PowerShell script. Through this process, the malware is installed on the device .
The installation of the trojan is unnoticed by the victim.
Additionally, Remcos is added to the auto-start group in the system, so it is automatically activated every time the device is turned on.
Once installed, the malware is able to steal all information entered into the web browser (information about the sites the user visits, data they enter, etc.). This way, hackers steal the victims' usernames and passwords.
Attackers gain access to accounts, while at the same time they can use the information they steal to carry out other attacks or to sell it on the dark web.
More information about the Remcos trojan and its capabilities can be found in the researchers' analysis
