Floki Bot Strikes, Talos and Flashpoint Respond
Summary: Cisco Talos analyzed Floki Bot, a new malware variant built on the leaked 2011 Zeus trojan source code and sold on darknet markets, finding a modified dropper, added Tor support that was not active in the samples examined, and code that injects into explorer.exe or svchost.exe. The bot32 resource was flagged by more than 30 antivirus engines on VirusTotal while bot64 was detected by only 10, and Talos worked with Flashpoint on active campaigns while releasing PayloadDump and other scripts to the open source community.
Bottom line: The same leaked Zeus codebase from 2011 is still being repackaged and sold, and the 64-bit payload slipping past most engines shows that detection coverage for a reworked variant of well-known malware is not guaranteed.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026