Surveillance Malware Trends: Tracking Predator Pain and Hawk Eye
Summary: Unit 42 analyzed the Predator Pain and HawkEye keylogger threat set from July through September 2015, noting both dump browser and e-mail client credentials, capture the display, and exfiltrate stolen data, with HawkEye sold openly on a commercial website and Predator Pain usually acquired through underground forums. Observed sessions peaked Monday through Wednesday after ramping up on Sunday, e-mail was the preferred delivery and exfiltration method, and the top ten targeted industries accounted for 82% of sessions across 80 targeted countries.
Key Takeaway: Nearly all adversaries using this threat set built phishing lists from publicly disclosed or leaked e-mail addresses and ran indiscriminate shotgun campaigns against addresses like sales@ and info@ that reach staff motivated by their importance to the business. With e-mail both the preferred delivery path and the preferred exfiltration channel, the same mailbox that carries the lure is often the one carrying the credentials back out.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026