Thread Rating:
  • 1 Vote(s) - 5 Average
  • 1
  • 2
  • 3
  • 4
  • 5
Malicious AutoHotkey Scripts Used to Steal Info, Remotely Access Systems
#1
Quote:Attackers are targeting potential victims using a malicious AutoHotkey script to avoid detection and to steal information, to drop more payloads, and to remotely access compromised machines using TeamViewer​​​​​​.
 
AutoHotkey (also known as AHK) is an open-source scripting language for Windows back in 2003 to add keyboard shortcuts (hotkeys) support in AutoIt, another free Windows automation language.
 
The malicious AutoHotkey script payload is delivered with the help of a decoy Excel Macro-Enabled Workbook email attachment named Military Financing.xlsm after the Foreign Military Financing (FMF) program of the U.S. Defense Security Cooperation Agency to trick potential targets into enabling macros to view the file's contents.
 
As discovered by Trend Micro's Cyber Threat Research Team. once the victims enabled macros in Microsoft Excel, the XSLM document will "drop the legitimate script engine AutoHotkey along with a malicious script file."
[Image: Attack%20chain.jpg]

SOURCE: https://www.bleepingcomputer.com/news/se...s-systems/
[-] The following 1 user says Thank You to silversurfer for this post:
  • harlan4096
Reply


Forum Jump:


Users browsing this thread: 1 Guest(s)
[-]
Welcome
You have to register before you can post on our site.

Username/Email:


Password:





[-]
Recent Posts
AWZ Screen Recorder
AWZ Screen Recorder ...zevish — 11:05
Website X5 Go 2024.1
Website X5 Go 2024.1...zevish — 09:32
Apple's rules to allow third-party app ...
Apple has announ...alison30 — 09:28
Intel: Microsoft AI PCs need a Copilot K...
Microsoft hopes th...harlan4096 — 08:55
Synchredible 8 Professional Edition v8.2...
          Synchredib...zevish — 08:54

[-]
Birthdays
Today's Birthdays
No birthdays today.
Upcoming Birthdays
No upcoming birthdays.

[-]
Online Staff
There are no staff members currently online.

>