FIN7 Group Uses Java Script and Stealer DLL Variant in New Attacks
Summary: Cisco Talos analyzed a FIN7 infection chain built from heavily base64-encoded JavaScript files that decode through multiple branches into a JavaScript bot and use reflective DLL injection via PowerShell to load an information-stealing DLL into memory. The stealer DLL targets Intelliform data via CryptUnprotectData, Outlook, Firefox, and login information from Google Chrome, Chromium, Chromium forks and Opera, then POSTs exfiltrated data to hardcoded command-and-control addresses including Google Apps Script hosting.
What you should know: The exfiltration rides on Google Apps Script, a legitimate Google hosting service, so blocking it means deciding how your network treats a mainstream cloud domain. The stealer's reach across Chrome, Chromium forks, Opera, Firefox and Outlook means a single successful injection puts credentials from most of your browser estate in the attacker's hands.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026