CISA: LokiBot Stealer Storms Into a Resurgence

[silversurfer]

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that the LokiBot info-stealing trojan is seeing a surge across the enterprise landscape.
 
The uptick started in July, according to the agency, and activity has remained “persistent” ever since.
 
LokiBot targets Windows and Android endpoints, and spreads mainly through email (but also via malicious websites, texts and messaging). It typically goes after credentials (usernames, passwords, cryptocurrency wallets and more), as well as personal information. The malware steals the data through the use of a keylogger to monitor browser and desktop activity, CISA explained.

“LokiBot has stolen credentials from multiple applications and data sources, including Windows operating system credentials, email clients, File Transfer Protocol and Secure File Transfer Protocol clients,” according to the alert, issued Tuesday. “LokiBot has [also] demonstrated the ability to steal credentials from…Safari and Chromium and Mozilla Firefox-based web browsers.”
 
To boot, LokiBot can also act as a backdoor into infected systems to pave the way for additional payloads.

Read more: https://threatpost.com/cisa-lokibot-stea...ce/159495/