Masslogger Trojan Campaigns Oomph Their “Mass” Aspect

By Bill Toulas / February 18, 2021

Researchers at Cisco Talos warn about the evolution of Masslogger trojan campaigns, as threat actors are bettering their obfuscation, detection evading, and credential harvesting methods. Also, the targeting scope is constantly widening, collecting sensitive info from an ever-increasing number of potential targets.

As Talos analysts explain, the most notable problem in the field right now is a new variant of the “Masslogger” trojan, which is capable of retrieving user credentials from multiple sources, including Microsoft Outlook, Google Chrome, and various instant messenger apps.

Source: Cisco Talos

First of all, the new Masslogger trojan is using a compiled HTML file to get the infection chain rolling. The file contains malicious JavaScript, which launches the malware process and arrives via a suspicious email with a business-related topic.

The email contains a RAR archive file, which in turn contains the HTML. Upon launch, the JS runs to load a PowerShell script, which deobfuscates into a downloader, fetching the main loader. These are hosted on compromised hosts that are otherwise legitimate, so in general, the victim is unlikely to see any security alerts.

Source: Cisco Talos

The main payload is a new variant of the Masslogger trojan, which is written in .NET and can steal user credentials from the following applications:

The latest campaigns seem to target mostly European countries, including Italy, Latvia, Turkey, Bulgaria, Lithuania, Hungary, Estonia, Romania, and Spain. However, the targeting scope may widen at any time, as all that the actors need to do for that is to create and use new phishing emails written in the targeted locales.

Source: Cisco Talos

Because the current campaign isn’t planting any components on the disk, except for the HTML file, they manage to evade detection very effectively. Everything takes place in volatile memory, and not many people care to run background memory scans to identify malicious processes.

What users can do to protect from these risks is to configure their systems to prevent PowerShell script execution. Of course, treating incoming emails with extra care would also be key in this case - and in most cases of this kind.

For a better user experience we recommend using a more modern browser. We support the latest version of the following browsers: For a better user experience we recommend using the latest version of the following browsers: