LokiBot Distributed via Fake Game Launcher

Since 2015 the trojan LokiBot has been used by cybercriminals to create backdoors into Windows machines. Its continued popularity can be partly attributed to the various and often novel ways it has been distributed in the past and the tactics it employs to infect machines. In the past researchers have discovered campaigns where the trojan was spread via steganography, the technique of hiding secret data, often in an image to avoid detection. In this instance, the data hidden was malicious code that when the image was opened a script would execute. Now hackers deploying the trojan are disguising it as a launcher for one of the world’s most popular video games, Fortnite. This new campaign was discovered by researchers at Trend Micro who previously also discovered the campaign using steganography in August 2019. It is believed that the fake launcher is distributed via a spam email campaign sent to numerous potential ...

SkyScanner App (Mac)

SkyScanner is a legitimate application, much like the skyscanner.net website, belongs to the Trip.com Group - a travel services provider. The SkyScanner app is designed to aid in search and booking of flights, hotels and car rentals. This application is genuine, however it has been promoted (by unaffiliated parties) via dubious methods. For example, through fake Flash Player updates. Illegitimate software updaters are commonly used to spread a variety of untrustworthy content - like adware, browser hijackers and other PUAs (Potentially Unwanted Applications); in some cases, these updates can even infect systems with malware (e.g. trojans, ransomware, etc.). Therefore, third party installation setups are likely to contain not only legitimate products (such as SkyScanner) but unwanted and/or malicious software as well. Potentially Unwanted Applications tend to appear genuine, wit...