Threat Actor Distributes Python-Based Info Stealer Using Fake Update

Tags

External References

• https://www.crowdstrike.com/
• https://otx.alienvault.com/

Description

An unidentified threat actor exploited the July 19, 2024 Falcon sensor content issue to distribute a Python-based information stealer named Connecio. The malware was delivered via a malicious ZIP file masquerading as a Falcon update. Connecio collects system information, browser data, and exfiltrates it over SMTP to attacker-controlled accounts. It also contains functionality for clipboard hijacking related to cryptocurrency addresses.

Date