Double Trouble: Latrodectus And ACR Stealer Observed Spreading Via Google Authenticator Phishing Site

Tags

External References

• https://cyble.com/
• https://otx.alienvault.com/

Description

The Cyble Research and Intelligence Lab (CRIL) discovered a sophisticated phishing website mimicking Google Safety Centre, designed to trick users into downloading malware. The malware, compromising security and stealing sensitive information, drops two threats: Latrodectus, which maintains persistence and collects user data; and ACR Stealer, which employs Dead Drop Resolver to obscure its Command and Control server. Latrodectus shows ongoing development with encryption key updates and new commands.

Date