New MrAnon Stealer Malware Targeting German Users via Booking-Themed Scam

A phishing campaign has been noticed offering an details stealer malware referred to as MrAnon Stealer to unsuspecting victims by way of seemingly benign reserving-themed PDF lures.

“This malware is a Python-primarily based info stealer compressed with cx-Freeze to evade detection,” Fortinet FortiGuard Labs researcher Cara Lin stated. “MrAnon Stealer steals its victims’ credentials, process facts, browser periods, and cryptocurrency extensions.”

There is proof to propose that Germany is the most important concentrate on of the attack as of November 2023, owing to the variety of times the downloader URL hosting the payload has been queried.

Masquerading as a company on the lookout to ebook resort rooms, the phishing email bears a PDF file that, on opening, activates the infection by prompting the receiver to down load an updated variation of Adobe Flash.

Doing so final results in the execution of .NET executables and PowerShell scripts to eventually operate a pernicious Python script, which is able of gathering data from various programs and exfiltrating it to a community file-sharing web page and the danger actor’s Telegram channel.

It can be also able of capturing data from instant messaging applications, VPN consumers, and documents matching a ideal listing of extensions.

MrAnon Stealer is offered by the authors for $500 for each month (or $750 for two months), together with a crypter ($250 for every thirty day period) and a stealthy loader ($250 for each thirty day period).

“The campaign in the beginning disseminated Cstealer in July and August but transitioned to distributing MrAnon Stealer in Oct and November,” Lin said. “This pattern suggests a strategic method involving the ongoing use of phishing e-mail to propagate a wide variety of Python-based mostly stealers.”

The disclosure arrives as the China-joined Mustang Panda is powering a spear-phishing email campaign focusing on the Taiwanese government and diplomats with an goal to deploy SmugX, a new variant of the PlugX backdoor that was earlier uncovered by Examine Point in July 2023.

Identified this post interesting? Adhere to us on Twitter  and LinkedIn to go through a lot more exclusive written content we publish.

Some parts of this article are sourced from:
thehackernews.com