Thursday, November 30, 2023

TrickBot Credential Stealer Malware Abuses Google Suite to Hide Malicious Activity

TrickBot is one of the top modular banking malware that primarily targets financial information of users’ and also it acts as a dropper for other malware.

The malware was first spotted in 2016 and it was mostly distributed via malvertising campaign, it evolves from a small banking trojan to an Access-as-a-Service model.

Trickbot New Malware Campaign

Unit 42 security researchers observed a new distribution campaign that delivered through phishing emails that has the subject lines as payroll or annual bonuses.

The campaign includes embedded links points to the legitimate Google Docs document which contains links to download the malicious file from Google drive. For further obfuscation email delivered through SendGrid.

According to Unit 42 research, “the email appeared to be originated from individuals at .edu email addresses and then attackers used SendGrid’s EDS to distribute the malware.”

The email contains the attractive text and links, once the user clicks on the link it gets redirected to the Google Doc document that contains the link of the file that hosted on the Google drive.

Attack Chain

From the Google drive, two executable downloaders appear as word document gets downloaded to the victim’s computer. Both the downloaders are signed with a digital certificate.

Upon opening the document it shows a fake pop-up that asks users to use Microsoft word 2019 and gives to option to close or to click ok. Regardless of the user response, the pop-up get’s closed and the downloaders proceed further downloading the Trickbot payload.

Fake Pop-up

Recent versions of the Trickbot includes a spamming component called TrickBooster that send spam emails from the Trickbot infected computer. It is also capable of leveraging Server Message Block (SMB) vulnerability for propagating to other systems on the same network.

This campaign legitimate services such as SendGrid and GSuite to obfuscate malicious activity. Researchers recommend organizations preventing download or execution of the unknown executable on the endpoint.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.


Latest articles

Chrome Zero-Day Vulnerability That Exploited In The Wild

Google has fixed the sixth Chrome zero-day bug that was exploited in the wild this...

Iranian Mobile Banking Malware Steal Login Credentials & Steal OTP Codes

An Android malware campaign was previously discovered that distributed banking trojans targeting four major...

BLUFFS: Six New Attacks that Break Secrecy of Bluetooth Sessions

Six novel Bluetooth attack methods have been discovered, which were named BLUFFS (Bluetooth Forward...

Google Workspace’s Design Flaw Allows Attacker Unauthorized Access

Recent years saw a surge in cloud tech adoption, highlighting the efficiency through tools...

Serial ‘SIM Swapper’ Sentenced to Eight Years in Prison

In a digital age marred by deceit, 25-year-old Amir Hossein Golshan stands as a...

Design Flaw in Domain-Wide Delegation Could Leave Google Workspace Vulnerable to Takeover – Hunters

BOSTON, MASS. and TEL AVIV, ISRAEL, November 28, 2023 - A severe design flaw...

Hackers Behind High-Profile Ransomware Attacks on 71 Countries Arrested

Hackers launched ransomware attacks to extort money from the following two entities by encrypting...

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles