Researchers warn of FFDroider and Lightning info-stealers targeting users in the wild

Cybersecurity scientists are warning of two diverse info-stealing malware, named FFDroider and Lightning Stealer, that are able of siphoning information and launching further attacks.

“Intended to send stolen qualifications and cookies to a Command & Regulate server, FFDroider disguises by itself on victim’s machines to seem like the instant messaging application ‘Telegram,'” Zscaler ThreatLabz scientists Avinash Kumar and Niraj Shivtarkar mentioned in a report posted very last 7 days.

Details stealers, as the name implies, are outfitted to harvest delicate facts from compromised devices, this sort of as keystrokes, screenshots, files, saved passwords and cookies from web browsers, that are then transmitted to a distant attacker-controlled area.

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

FFDroider is distributed by means of cracked versions of installers and freeware with the most important objective of thieving cookies and credentials affiliated with well known social media and e-commerce platforms and applying the plundered details to login into the accounts and seize other individual account-associated information and facts.

Web browsers targeted by the malware incorporate Google Chrome, Mozilla Firefox, Internet Explorer, and Microsoft Edge. The websites targeted encompass Facebook, Instagram, Twitter, Amazon, eBay, and Etsy.

“The stealer indicators into victims’ social media platforms using stolen cookies, and extracts account details like Fb Adverts-manager to operate malicious adverts with saved payment strategies and Instagram through API to steal own data,” the researchers reported.

FFDroider also arrives with a downloader performance to upgrade alone with new modules from an update server that enables it develop its element established in excess of time, enabling malicious actors to abuse the stolen information as a vector for initial entry to a target.

Key Purpose of Lightning Stealer

Lightning stealer operates in a comparable trend in that it can steal Discord tokens, details from cryptocurrency wallets, and specifics pertaining to cookies, passwords, credit cards, and look for background from extra than 30 Firefox and Chromium-centered browsers, all of which is exfiltrated to a server in JSON format.

“Information Stealers are adopting new strategies to turn out to be a lot more evasive,” Cyble scientists mentioned, adding it “witnessed ransomware groups leveraging Facts Stealers to achieve preliminary network entry and, sooner or later, exfiltrating sensitive knowledge.”

The development comes as stealer malware is becoming an progressively common event throughout diverse attack strategies in new months, in portion to fill the void still left by Raccoon Stealer’s exit from the marketplace in late March due to the ongoing war in Ukraine.

In February 2022, Cyble Research disclosed information of an emerging risk called Jester Stealer that’s engineered to steal and transmit login qualifications, cookies, credit history card facts along with details from passwords managers, chat messengers, email customers, crypto wallets, and gaming apps to the attackers.

Considering that then, at least 3 distinct information-stealers have emerged in the wild, such as BlackGuard, Mars Stealer, and META, the previous of which has been noticed sent by means of malspam campaigns to acquire delicate facts.

Discovered this posting appealing? Adhere to THN on Fb, Twitter  and LinkedIn to browse a lot more exclusive written content we put up.