Kaspersky\nresearchers have detected an unusual malicious campaign that uses a phishing\ncopy of a popular VPN service\u2019s website to spread AZORult, a Trojan stealer,\nunder the guise of installers for Windows. <\/p>\n\n\n\n
The\ncampaign, which kicked off at the end of last November with the registration of\na fake website, is currently active and focused on stealing personal\ninformation and cryptocurrency from infected users. This shows that\ncybercriminals are still hunting for cryptocurrency, despite reports that\ninterest in the currency has died down. <\/p>\n\n\n\n
Last\nyear, the malware targeted 78,189 users in Africa, with 16,975 users located in\nSouth Africa, 8,165 in Kenya and 1,965 in Nigeria. In January, there was a continuation\nof this dangerous trend, with 759 users hit in South Africa, 128 in Nigeria and\n639 in Kenya.<\/p>\n\n\n\n
AZORult is one of the most\ncommonly bought and sold stealers on Russian forums due to its wide range of\ncapabilities. This Trojan poses a serious threat to those whose computers may\nhave been infected as it is capable of collecting various data, including\nbrowser history, login credentials, cookies, files from folders, cryptowallet\nfiles and can also be used as a loader to download other malware.<\/p>\n\n\n\n
Links to the\ndomain are spread through advertisements via different banner networks. The victim\nvisits the phishing website and is prompted to download a free VPN installer.\nOnce a victim downloads a fake VPN installer for Windows, it drops a copy of\nAZORult botnet implant. As soon as the implant is run, it collects the infected device’s environment information and reports\nit to the server. Finally, the attacker steals cryptocurrency from locally\navailable wallets.<\/p>\n\n\n\n
Upon\nthe discovery of the campaign, Kaspersky immediately informed the VPN service\nin question about the issue and blocked the fake website.<\/p>\n\n\n\n
\u201cThis\ncampaign is a good example of how vulnerable our personal data is nowadays,\u201d\nsaid Dmitry Bestuzhev, Head of GReAT in Latin America.<\/p>\n\n\n\n
\u201cIn\norder to protect it, users need to be cautious and be especially careful when\nsurfing online. <\/p>\n\n\n\n
\u201cThis\ncase also shows why cybersecurity solutions are needed on every device. When it\ncomes to phishing copies of websites, it is very difficult for the user to\ndifferentiate between a real and a fake version. Cybercriminals often\ncapitalise on popular brands and this trend is not likely to die down. We\nstrongly recommend using VPN for protection of data exchange on the web, but it\nis also important to closely study where the VPN software is downloaded from.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"
Kaspersky researchers have detected an unusual malicious campaign that uses a phishing copy of a popular VPN service\u2019s website to spread AZORult, a Trojan stealer, under the guise of installers for Windows. The campaign, which kicked off at the end of last November with the registration of a fake website, is currently active and focused […]<\/p>\n","protected":false},"author":25,"featured_media":32041,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[9058,5,275,19,54,9059,13,262,9060],"tags":[12627,1887,449,12628,226,297,101,685,1415,453,1927,1240,177],"class_list":["post-32040","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-east-africa","category-enterprise-security","category-intelligent-technology-newsletter","category-regional-news","category-research","category-south-africa","category-top-stories","category-used","category-west-africa","tag-azorult","tag-cryptocurrency","tag-cybercriminals","tag-dmitry-bestuzhev","tag-kaspersky","tag-kenya","tag-malware","tag-nigeria","tag-phishing","tag-south-africa","tag-trojan","tag-vpn","tag-windows"],"acf":[],"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/posts\/32040","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/comments?post=32040"}],"version-history":[{"count":5,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/posts\/32040\/revisions"}],"predecessor-version":[{"id":32046,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/posts\/32040\/revisions\/32046"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/media\/32041"}],"wp:attachment":[{"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/media?parent=32040"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/categories?post=32040"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/tags?post=32040"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}