Security researchers have discovered an updated version of the LightSpy malware, which includes new features to collect and steal data from social media platforms like Facebook and Instagram.
LightSpy is a modular spyware that infects Windows and Apple with the aim of collecting data. It was first detected in 2020, when it targeted users in Hong Kong.
Until now, the malware could steal a wide range of data, including Wi-Fi network information, screenshots, location data, iCloud Keychain, audio recordings, photos, browser history, contacts, call history, SMS messages, and data from various apps such as Files, LINE, Mail Master, Telegram, Tencent QQ, WeChat, and WhatsApp.
See also: Pegasus Spyware targets private and financial sectors
Late last year, ThreatFabric released an updated version of LightSpy that prevented the compromised device from booting, while the supported malicious plugins had increased from 12 to 28.
's Hunt.io latest analysis , however, shows that the LightSpy malware now supports more than 100 malicious commands, which target Android, iOS, Windows, macOS, routers, and Linux.
The new command list shifts the focus from direct data collection to broader operational control, including transmission management and plugin version tracking.
Researchers say the new capabilities make the LightSpy malware more flexible, allowing operators to more effectively manage different systems.
One of the most important new commands is targeting application database files of Facebook and Instagram applications, to extract data from Android devices.
See also: WhatsApp: Israeli spyware targeted users and journalists
15 plugins for Windows devices were also discovered , which monitor systems and collect data. Most of the plugins deal with keystroke logging , audio recording, and USB interaction.
An endpoint (“/phone/phoneinfo”) was also detected in the admin panel that provides logged-in users with the ability to remotely control infected mobile devices.
“The shift from targeting messaging apps to targeting Facebook and Instagram expands the LightSpy malware’s ability to harvest private messages, contact lists, and account metadata from widely used social media platforms,” Hunt.io said.
“Extracting these files could provide attackers with stored conversations, user logins, and possibly session-related data, increasing surveillance capabilities and opportunities for further exploitation“.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Spyware protection
One of the most effective ways to protect yourself is to use reputable security. These programs scan your device for spyware and remove it. They also offer real-time protection, alerting you when an app tries to install spyware on your device.
See also: Amazon Appstore: Android spyware was disguised as a health app
It's also important to keep your operating system and all programs up to date. These updates often include security fixes that can help protect your computer from spyware.
Another important tip is to be careful with the emails and messages you receive. This software is often spread through phishing, where attackers try to convince you to click on a malicious link or open a dangerous attachment.
Finally, it's important to always have backups of your important files. While this won't protect you directly, it will help you recover your data if your device is compromised.
Source: thehackernews.com
