New Hawk Eye Reborn Variant Emerges Following Ownership Change
Summary: Cisco Talos reports that after a December 2018 HackForums thread described a change in ownership of the HawkEye keylogger, new versions were marketed as HawkEye Reborn v9 under a tiered licensing model, and Talos observed ongoing malspam campaigns distributing it against organizations. The campaigns use emails posing as invoices and order confirmations with malicious Excel, RTF and DOC files, and the payload steals browser, Filezilla, CoreFTP and Minecraft credentials, logs keystrokes, captures clipboard, screenshots and webcam images, and exfiltrates over email, FTP, SFTP or HTTP.
Key Takeaway: The seller's own Terms of Service forbid scanning HawkEye Reborn executables with antivirus software, and the malware disables security applications via Image File Execution Options - so a licensed, commercially supported stealer is being aimed at your users through ordinary invoice emails.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026