VIPKeyLogger: Steals credentials via dangerous Office files

VIPKeyLogger malware , similar to Snake Keylogger, spreads through phishing attacks , and disguises itself as file attachments, which mimic Microsoft 365 documents or archive files.

VIPKeyLogger is distributed via malicious Microsoft Office, which leverage a command-and-control (C2) infrastructure. Its main goal is to collect sensitive data, such as login credentials, financial information, system data, and personally identifiable information.

See also: Hackers use Yokai Malware

The analysis showed that a malicious RTF document, disguised as a file related to the CVE-2017-11882 vulnerability, contained encoded data that directed to URLs to download executable files. These executables use obfuscation and steganography techniques to cover up malicious code, which is activated upon execution.

Read also: New Pumakit malware affects Linux systems

The code collects information such as system details, clipboard content, browsing history, screenshots, and cookies. The data is then exported via a Telegram bot to DuckDNS servers, giving hackers remote access.

The malware infiltrates systems via phishing emails with malicious attachments, creating persistence by storing files in system folders. It extracts critical data, such as keystrokes, screenshots, and email credentials, and transfers them to a C2 server.

See also: New malware technique exploits Windows UIA

Forcepoint protects its users by blocking malicious attachments and URLs to prevent additional payloads from being downloaded. It also adds dropper files to its database and intercepts communication with C2 servers, preventing hackers from accessing them and enhancing user security.

Source: gbhackers