Security News > 2022 > May > Ukraine warns of “chemical attack” phishing pushing stealer malware
Ukraine's Computer Emergency Response Team is warning of the mass distribution of Jester Stealer malware via phishing emails using warnings of impending chemical attacks to scare recipients into opening attachments.
Ukrainians live under this constant fear, so these phishing emails pretend to be warnings of chemical attacks to ensure that recipients won't ignore their messages.
The payload dropped on the victim's system is Jester Stealer, an info-stealing malware strain gaining popularity in 2022 thanks to its extensive capabilities and affordable prices.
Jester Stealer is a powerful information-stealing trojan that steals data data stored in browsers such as account passwords, messages on email clients, discussions on IM apps, and cryptocurrency wallet details.
A unique characteristic of Jester Stealer is its use of AES-CBC-256 encryption for communicating with its operators via Tor network servers and transmitting the stolen data to private Telegram channels.
Jester Stealer is licensed to anyone for $99 per month or $249 for lifetime access, so chances are this campaign is orchestrated by low-skilled opportunists.
News URL
Related news
- CERT-UA Warns of Phishing Attacks Targeting Ukraine’s Defense and Security Force (source)
- Phishing-as-a-Service "Rockstar 2FA" Targets Microsoft 365 Users with AiTM Attacks (source)
- GenAI makes phishing attacks more believable and cost-effective (source)
- Ongoing Phishing and Malware Campaigns in December 2024 (source)
- Inside the incident: Uncovering an advanced phishing attack (source)
- Secret Blizzard Deploys Kazuar Backdoor in Ukraine Using Amadey Malware-as-a-Service (source)
- New IOCONTROL malware used in critical infrastructure attacks (source)
- FBI spots HiatusRAT malware attacks targeting web cameras, DVRs (source)
- Ongoing phishing attack abuses Google Calendar to bypass spam filters (source)
- Rspack npm Packages Compromised with Crypto Mining Malware in Supply Chain Attack (source)