A new cyberattack aimed at infecting users' computers with the Vawtrak banking Trojan has been detected by security researchers and is based on a multi-stage routine that involves the use of Microsoft Word documents with malicious macros.
The list of banks targeted by the current campaign includes: Bank of America, Barclays, Citibank, HSBC, LLOYD'S Bank and JP Morgan.
The attackers rely on multiple tactics to disguise the attack, one of which is to provide seemingly encrypted document content, which is decrypted only after enabling the macro function in Word.
Another tactic is to deliver a VBS file that has a “- -ExecutionPolicy bypass” policy flag enabled. This is used by system administrators as a security mechanism to prevent users from executing scripts if they do not comply with policy requirements.
Scripts with the “bypass” command can execute files without restrictions and without producing warnings.
The malicious emails purport to come from reputable services such as FedEx, informing recipients of the arrival of a package, or from American Airlines, informing recipients of transactions made with their payment card.
All messages have a Word document attached that purports to offer more details about the subject matter the message refers to.
When the victim opens the text file, they will be asked to enable macros.
Microsoft it began to be abused by malicious actors. However, users who need macros to perform automated tasks can enable them.
In the case of Vawtrak, the macro contains commands to download a batch file, a VBS script, and a PowerShell file. The batch file runs the VBS, which in turn runs the PowerShell file that injects the malware into the system.
Trend Micro reports that this variant of Vawtrak steals Microsoft Outlook, as well as credentials stored in Google Chrome and Mozilla Firefox, and FTP clients.
Analysis of the malware revealed that it can connect to the browser and bypass the SSL.
The largest number of infections with this version of Vawtrak has been observed in the US (60.71%), followed by Japan (10.22%), Germany (6.83%), the UK (4.47%), and Australia (3.42%).
