Trump Cryptocurrency Delivers ConnectWise RAT

March 11, 2025, 6:53 p.m.

Description

An email campaign impersonating Binance is offering fake TRUMP coins to lure victims into downloading a malicious 'Binance Desktop' application, which actually installs ConnectWise RAT. The attackers have created a convincing web page mimicking Binance's interface to host the malware download. Once infected, threat actors quickly establish remote control of the victim's computer, targeting saved passwords in applications like Microsoft Edge. The campaign employs sophisticated social engineering tactics, including sender name spoofing and risk warnings, to appear legitimate. Threat actors are actively monitoring infections and can connect to compromised systems within minutes of installation.

Date

  • Created: March 11, 2025, 5:34 p.m.
  • Published: March 11, 2025, 5:34 p.m.
  • Modified: March 11, 2025, 6:53 p.m.

Indicators

  • shopifycourses.store

Attack Patterns