Beware Fickle Stealer: The Rust-Based Malware Wreaking Havoc on Your Data Security
Fortinet FortiGuard Labs has identified a new malware, Fickle Stealer, that uses various attack chains to harvest sensitive information. This Rust-based stealer utilizes PowerShell scripts to bypass security and targets data from crypto wallets, web browsers, and popular applications like Skype and Discord.
Hot Take:
Move over, Ocean’s Eleven! We’ve got a new heist crew in town, and they’re armed with PowerShell scripts and packing JSON strings. This is one data-stealing drama with more plot twists than a soap opera!
Key Points:
– **Fickle Stealer**: A Rust-based malware targeting sensitive information from compromised hosts.
– **Distribution Methods**: Delivered through VBA dropper, VBA downloader, link downloader, and executable downloader.
– **PowerShell Trickery**: Uses scripts to bypass User Account Control (UAC) and report victim data to a Telegram bot.
– **Stealth Mode**: Employs anti-analysis checks and exfiltrates data in JSON format.
– **Target Rich Environment**: Goes after crypto wallets, popular web browsers, and applications like AnyDesk, Discord, and Telegram.