Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Banking Trojan Escelar Infects Thousands In Brazil and the US

Summary: Unit 42 tracked the Escelar banking Trojan for three months after it surfaced in January, recording roughly 100,000 attempted infections and over 600 variants, delivered mainly through Portuguese-language phishing emails targeting seven Brazilian banks and users in Brazil and the US. The malware runs in three .NET stages that download payloads over direct connections to Microsoft SQL servers also used for command and control, and one such server held records of 1,660 infections that connected within a two-day window.

Why it matters: Escelar harvests email credentials and reuses them to send more phishing mail - one database showed 3,057 emails sent from stolen accounts - so a single infected mailbox becomes distribution infrastructure for the next victim. It also tricks users into entering the SMS authentication code their bank sends, which means the second factor your bank relies on is being collected by the attacker in the same session.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related