The infamous TrickBot malware accidentally dropped a test module that warns victims that they are infected and should contact their administrator.
TrickBot is a malware infection that is usually distributed via malicious spam messages. Once installed, the malware runs silently on the machine while downloading various modules that perform different tasks on the infected computer.
These modules allow the malware to steal a domain's Active Directory Services database, collect passwords and browser cookies, steal OpenSSH keys, and spread laterally across a network.
To make matters worse, TrickBot is known to complete its attacks by giving access to ransomware operators like Ryuk and Conti.
TrickBot's developers made a mistake
In a recent version of the TrickBot malware analyzed by Advanced Intel's Vitali Kremez, hackers accidentally distributed a trial version of the password-stealing grabber.dll module.
When loaded, this module displays a warning in the default browser stating that the program is collecting information and that the victim should ask their system administrator.
This warning is not an isolated case, as BleepingComputer found a user infected with TrickBot who posted a related question with this warning 16 days ago on Reddit.
"Firefox is warning me about a program called grabber. What is this and what should I do?" the user asked on Reddit.
Grabber.dll is TrickBot's password and cookie stealing module that attempts to collect browser credentials and cookies from Chrome, Edge, Internet Explorer , and Firefox. These stolen credentials and cookies can then be used to log in to the victim's accounts.
