Smoking Guns - Smoke Loader learned new tricks
Summary: Cisco Talos tracked a new Smoke Loader sample, delivered through a malicious Word document that downloaded Trickbot, which in turn dropped Smoke Loader and five credential-stealing plugins. The sample is among the first real-world malware to use the PROPagate injection technique, using GetShellWindow and GetWindowThreadProcessId to target Explorer.exe rather than iterating process lists.
What's compelling: The plugins target stored credentials and browser traffic, including Windows and TeamViewer credentials, email logins, FTP, SMTP, POP3 and IMAP, and Outlook, Thunderbird and The Bat! mail stores - and the sample left six Explorer.exe processes running on the infected host.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026