The credential-stealing malware was found in keygen and Cracks related websites to circumvent licensing restrictions to legit software.
The IT security researchers at Proofpoint researchers have discovered a new malware strain that has widespread credential-stealing capabilities.
Aptly dubbed CopperStealer; this new strain can steal user credentials from biggies like Facebook, Amazon, Google, and Apple apart from other mainstream online platforms.
“Our investigation uncovered an actively developed password and cookie stealer with a downloader function, capable of delivering additional malware after performing stealer activity,” researchers wrote.
CopperStealer Credential Stealing Capabilities
It is basically a password and cooking stealer containing a download feature that lets its operators deliver additional payloads to infected devices. This malware is currently in active development. The earliest samples of this malware were discovered in July 2019.
While investigating, Proofpoint researchers observed a sample targeting advertisers and business accounts on Facebook and Instagram. However, the researchers also identified new versions of CopperStealer that targeted PayPal, Bing, Twitter, and Tumblr.
The browsers searched by CopperStealer for saved passwords include Chrome, Edge, Yandex, Opera, and Firefox.
Suspicious KeyGen and Crack Sites Discovered
Proofpoint researchers reported that CopperStealer was identified after they found suspicious websites advertised as KeyGen or Crack sites. They checked out many different hosting samples, including crackheap[.]net, startcrack[.]com, keygenninja[.]com, and piratewares[.]com.
These aforementioned websites, according to researchers were delivering malware families, one of which was CopperStealer. The sites promised to offer Serials, Keygen, and Cracks to circumvent licensing restrictions to legit software. Instead, they provided Potentially Unwanted Programs (PUP)/Applications and malicious executables that could install and download many more payloads.
copperstealer malware stealing facebook apple google passwords
