Security researchers have discovered a new hacking campaign aimed at spreading the Azorult malware. The hackers behind the campaign are abusing ProtonVPN , presenting Azorult as a ProtonVPN installer to infect Windows computers.
Researchers have identified several victims of the Azorult malware. This malware is often sold on Russian hacking forums. It is one of the most expensive and sought-after malware because it offers a wide range of capabilities.
In this particular campaign, hackers created a fake ProtonVPN site, which is an exact HTTrack copy of the real ProtonVPN site. The criminals manage to spread Azorult by presenting it as an installer package for Windows computers.
The campaign began in November 2019 and appears to originate from Russia.
Attackers use various infection vectors to spread the Azorult malware and affect Windows systems. A common distribution method is Malvertising.
If users visit the fake ProtonVPN site and download the fake ProtonVPN installer for Windows, they will receive a copy of the Azorult botnet.
After the computer is infected, Azorult begins collecting system information. It then sends the stolen information to the attackers via a command and control server located on the same accounts[.]protonvpn[.]store server.
According to Kaspersky researchers , the Azorult malware targeting Windows computers was designed in such a way that it can steal: cryptocurrencies (Electrum, Bitcoin, Etherium, etc.), FTP logins and passwords from FileZilla , email credentials , browser information (including cookies), credentials for WinSCP , Pidgin Messenger , and much more data.
