iBanking is a malicious Android application that when installed on a mobile phone is able to spy on its user’s communications. This bot has many interesting phone-specific capabilities, including capturing incoming and outgoing SMS messages, redirecting incoming voice calls, and even capturing audio using the device’s microphone.
DNS hijacking is still going strong and the Win32/Sality operators have added this technique to their long-lasting botnet. This blog post describes how the malware guesses router passwords as part of its campaign to misdirect users, send spam and infect new victims.
Malware researchers at ESET have uncovered a widespread cybercriminal operation that has seized control of tens of thousands of Unix servers. Learn more about how to check your systems for compromise, and prevent innocent computer users from being attacked.
Our report titled “Operation Windigo – the vivisection of a large Linux server-side credential-stealing malware campaign” details our analysis of a set of malicious programs that infect servers and desktop PCs, and send nearly 500,000 web users to malicious content daily.”
The year 2013 was notable for the appearance of 0-day vulnerabilities that were primarily used in targeted attacks. In this case, criminal hackers worked on developing exploits, only not for random propagation of malicious code, but rather for use in attacks on specific users.
‘The first thing you need to know about quantum cryptography is that it isn’t cryptography. At least, not the quantum part,’ writes Rob Slade, information security researcher, author and malware expert.
In this post, we examine the complex it fits into a larger click fraud ecosystem, where users can be redirected either automatically, or through search engines browsing, to advertisement websites.
This is the first in a series of two blog posts on the malware family Win32/Boaxxe.BE whose end goal is to drive traffic to advertisement websites by using various click fraud techniques, and thus earn money from these websites as an “advertiser”.
Death of a Sales Force: Whatever Happened to Anti-Virus? is a paper written by Larry Bridwell and myself for the 16th AVAR conference in Chennai, which was kindly presented by ESET’s Chief Research Officer Juraj Malcho, as neither Larry nor myself were able to attend the conference in the end. The paper is also available
The first sign we saw of this malware was in mid-May 2013, but it is still very active, and uses Android to bypass two-factor authentication systems. It clearly seeks to infect Dutch computers – 75% of detections come from this region.
In September we informed about a new banking trojan called Hesperbot (detected as Win32/Spy.Hesperbot). The perpetrators responsible for the threat are still active – November has been particularly eventful. In this post, we’ll give an update on the situation and malware developments.
By the middle of May, users around the world started to receive messages from their contacts through different instant-messaging applications, such as Skype and Gtalk – an attack that showed off how age-old techniques can ensnare thousands of users. Here, we analyze this attack.
On November 2nd, 1988, the Morris worm was released by its author, and within 24 hours had caused damage across the world. It spread via the internet – and its release marked a new dawn for malicious software. Our five facts highlight what has changed since – and what hasn’t.
We have already discussed how a system gets infected with Win32/Nymaim ransomware. In this blog post, we reveal a new infection vector, a study of the different international locker designs and ransom prices as well as a complete technical analysis of its communication protocol.
Indonesia as a major source of malicious traffic? That’s what a recent infographic from content delivery network provider Akamai seemed to say. In her first article for We Live Security, ESET security researcher Lysa Myers investigates.