Feeds

Evil '666' auto-whaler tool is even eviler than it seems

Robs the robbers who rob the robbers

Internet Security Threat Report 2014

Hackers have created a fake tool especially designed to exploit the laziness of the most clueless and unskilled phishing fraudsters.

The fake tool poses as a utility that scours the net for fraudulent sites and pilfers any login credentials that victims might have entered, making them available to crooks who had nothing to do with the original fake site. Tools of this type are called auto-whalers and are by no means unprecedented.

This particular variant, however, comes with surprise backdoor functionality, GFI Software has discovered. The utility actually steals passwords from a user's machine using a password-stealing Trojan called Fignotok-A.

The malware is ultimately designed to snatch gaming account logins and IM passwords. Frankly though, anyone using an application called 666 auto-whaler.exe that uses a balaclava-sporting terrorist as an icon, as in this case, shouldn't be that surprised if it turns out to be less than healthy for their own security. Undoctored 666 auto-whaler.exe utilities are out there, but the sample analysed by GFI certainly isn't one of them – those unscrupulous enough to use it are probably naive enough not to check whether it's safe or not.

Previous examples of this sort of dishonour-among-thieves involved supposed phishing toolkits that actually sent stolen IDs back to the tool's authors – rather than the people who were using the tool to create fake banking websites and the like. The Trojaned auto-whaler tool is targeted even lower down the food chain, to would-be crooks who would even have trouble with point and click tools, potentially encompassing those not even out of short pants.

"Password stealer creators targeting whalers going after phishers may sound like a humorously confusing mess of bad people hitting each other in the face with bricks – and don't think I haven't thought about it – but the gag quickly evaporates once Little Jimmy loses five sets of credit card details to the void," writes Christopher Boyd, a security researcher at GFI Software.

A full write-up of the scam can be found in a blog post by GFI here. ®

Top 5 reasons to deploy VMware with Tegile

More from The Register

next story
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
You stupid BRICK! PCs running Avast AV can't handle Windows fixes
Fix issued, fingers pointed, forums in flames
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
10 threats to successful enterprise endpoint backup
10 threats to a successful backup including issues with BYOD, slow backups and ineffective security.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Protecting users from Firesheep and other Sidejacking attacks with SSL
Discussing the vulnerabilities inherent in Wi-Fi networks, and how using TLS/SSL for your entire site will assure security.