Windows 10: Trickbot banking malware added password and browser history stealing

Brink · Nov 9, 2018

The Trickbot banking malware has added yet another tool to its arsenal, allowing crooks to steal passwords as well as steal browser data including web history and usernames.

The malware first appeared in 2016, initially focused on stealing banking credentials - but Trickbot is highly customisable and has undergone a series of updates since then. The latest trick - picked up by researchers at both Trend Micro and Fortinet - is the addition of a new module designed to steal passwords.

This new Trickbot variant first emerged in October and is delivered to victims via a malicious Excel document.

Like many forms of malware, the malicious package is spread via macros: the user is told their document was created in an older version of Excel and that they must 'enable content' to view the file. This allows macros to run and executes malicious VBS code which kicks off the process of the malware download...
Click to expand...

Read more: This banking malware just added password and browser history stealing to its playbook | ZDNet

:)

magilla · Nov 9, 2018

This password-stealing malware just added a new way to infect your PC

Read more: This password-stealing malware just added a new way to infect your PC | ZDNet
Click to expand...

It’s a dangerous world we live in!

Borg 386 · Nov 9, 2018

This password-stealing malware just added a new way to infect your PC

A powerful form of malware which can be used to distribute threats including Trojans, ransomware and malicious cryptocurrency mining software has been updated with a new technique which has rarely been seen in the wild.
Click to expand...

What intrigued researchers is how Smoke Loader is now using an injection technique which hadn't been used to distribute malware until just days ago. The code injection technique is known as PROPagate and was first described as a potential means of compromise late last year.

This technique abuses the SetWindowsSubclass function -- a process used to install or update subclass windows running on the system -- and can be used to modify the properties of windows running in the same session. This can be used to inject code and drop files while also hiding the fact it has happened, making it a useful, stealthy attack.

It's likely that the attackers have observed publicly available posts on PROPagate in order to recreate the technique for their own malicious ends.

Those behind this process have also added anti-analysis techniques to complicate forensics, runtime AV scanners, tracing, and debugging that any researchers may attempt to conduct on the malware.
Click to expand...

While there's still plenty of Smoke Loader attacks which look to deliver additional malware to compromised systems, in some cases the malware is being equipped with its own plug-ins to go straight onto performing its own malicious tasks.

Each of these plugins are designed to steal sensitive information, specifically stored credentials or sensitive information transferred over a browser -- the likes of Firefox, Internet Explorer, Chrome, Opera, QQ Browser, Outlook, and Thunderbird can all be used to steal data.

The malware can even be injected into applications like TeamViewer, potentially putting the credentials of others on the same network as the infected machine at risk too.
Click to expand...

Read more: This password-stealing malware just added a new way to infect your PC | ZDNet

ck200011 · Nov 9, 2018

Can't view a copy of a cancelled check online banking site using the edge browser.

Hi,

Welcome to Microsoft Community and thank you for posting your query. Your interest in Windows 10 is much appreciated.

I understand the inconvenience that you are unable to view online banking site using the Microsoft Edge, we will help you to resolve this issue.

Please let us know if you have tried to access this website using any other browser.

I suggest you to clear cache and cookies from the Microsoft Edge browser.

Steps:

Open Microsoft Edge, click on
More Action at the right top corner.

Click on Settings, click on
Choose what to clear under Clear browsing data.

Select the Browsing history, caches and cookies and hit
Clear.

Close the browser and try to open it again.

Hope this information is helpful. Kindly update the status of the issue, we will be happy to help you.
Click to expand...

I cleared browsing history, caches and cookies. No luck. The online bank site opens a blank screen, but no access to the needed pdf.

I then went back to Edge settings at the right top corner. Opened settings . Clicked on "open with Internet Explorer". Signed in at the online bank site . Clicked on " view check". A second window opened and I could view the check.

Windows 10: Trickbot banking malware added password and browser history stealing

Trickbot banking malware added password and browser history stealing

Trickbot banking malware added password and browser history stealing

Trickbot banking malware added password and browser history stealing

Trickbot banking malware added password and browser history stealing - Similar Threads - Trickbot banking malware

Attempt to steal passwords

Attempt to steal passwords

Trickbot Malware

Bank password

This password-stealing malware just added a new way to infect your PC

Best Browser & Configuration for Banking?

Dyre banking malware: Windows 10 and Edge browser now targets

Browser History...

browser history