Masslogger campaigns exfiltrates user credentials
Summary: Cisco Talos documented a Masslogger credential-stealing campaign that began in mid-January and targeted organizations in Turkey, Latvia and Italy, with earlier campaigns from September 2020 onward hitting Bulgaria, Lithuania, Hungary, Estonia, Romania and Spain. The infection starts with a phishing email carrying a RAR attachment renamed with .r00 and .chm extensions, then moves through obfuscated JavaScript in a compiled HTML file, a PowerShell downloader, and a PowerShell loader that injects the Masslogger 3.0.7563.31381 payload into msbuild.exe, exfiltrating credentials over FTP to med-star.gr.
Why it matters: The entire chain runs in memory except the attachment and CHM file, and the stolen credentials are packaged with username, country ID, machine ID and timestamp for sale or reuse on the dark web - so an infection that never touches disk can still hand over the keys to your business applications.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026