New Ursnif Variant Spreads Through Infected Word Documents

New Ursnif Variant Spreads Through Infected Word Documents

Application Security , Cybercrime , Fraud Management & Cybercrime

Banking Trojan Designed to Steal Passwords and Credentials Akshaya Asokan (asokan_akshaya) • August 9, 2019     Malicious Word document hiding Ursinf Trojan (Source: Fortinet)

A new variant of the Ursnif Trojan is targeting vulnerable systems in an attempt to steal banking passwords and other credentials. The malware is spreading through infected Microsoft Word documents, and it has the ability to evade advanced security filters, according to researchers at Fortinet.
See Also:


Webinar | The Future of Adaptive Authentication in Financial Services

Ursnif has been around in some form for about 10 years and has grown more popular over that time. The latest variant appears to have been compiled around July 26 and is spreading through phishing emails that contain malicious Word documents, Fortinet researchers note in a blog. The file, which was identified as "info_[date].doc," has been actively spreading over the last month, the researchers say.


"This threat is actively spreading," Xiaopeng Zhang, a researcher with Fortinet, notes in the blog. "During my analysis, which started with just a few samples, the volume of captured samples and the number of triggers this new variant set off in our global network of sensors kept growing."


Although the number of systems that have been infected by the updated Ursnif variant remains unclear, the Fortinet researchers say that they have gathered seve ..

Support the originator by clicking the read the rest link below.