Feeds

Evil '666' auto-whaler tool is even eviler than it seems

Robs the robbers who rob the robbers

Providing a secure and efficient Helpdesk

Hackers have created a fake tool especially designed to exploit the laziness of the most clueless and unskilled phishing fraudsters.

The fake tool poses as a utility that scours the net for fraudulent sites and pilfers any login credentials that victims might have entered, making them available to crooks who had nothing to do with the original fake site. Tools of this type are called auto-whalers and are by no means unprecedented.

This particular variant, however, comes with surprise backdoor functionality, GFI Software has discovered. The utility actually steals passwords from a user's machine using a password-stealing Trojan called Fignotok-A.

The malware is ultimately designed to snatch gaming account logins and IM passwords. Frankly though, anyone using an application called 666 auto-whaler.exe that uses a balaclava-sporting terrorist as an icon, as in this case, shouldn't be that surprised if it turns out to be less than healthy for their own security. Undoctored 666 auto-whaler.exe utilities are out there, but the sample analysed by GFI certainly isn't one of them – those unscrupulous enough to use it are probably naive enough not to check whether it's safe or not.

Previous examples of this sort of dishonour-among-thieves involved supposed phishing toolkits that actually sent stolen IDs back to the tool's authors – rather than the people who were using the tool to create fake banking websites and the like. The Trojaned auto-whaler tool is targeted even lower down the food chain, to would-be crooks who would even have trouble with point and click tools, potentially encompassing those not even out of short pants.

"Password stealer creators targeting whalers going after phishers may sound like a humorously confusing mess of bad people hitting each other in the face with bricks – and don't think I haven't thought about it – but the gag quickly evaporates once Little Jimmy loses five sets of credit card details to the void," writes Christopher Boyd, a security researcher at GFI Software.

A full write-up of the scam can be found in a blog post by GFI here. ®

New hybrid storage solutions

More from The Register

next story
Google recommends pronounceable passwords
Super Chrome goes into battle with Mr Mxyzptlk
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Reddit wipes clean leaked celeb nudie pics, tells users to zip it
Now we've had all THAT TRAFFIC, we 'deplore' this theft
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
TorrentLocker unpicked: Crypto coding shocker defeats extortionists
Lousy XOR opens door into which victims can shove a foot
Greater dev access to iOS 8 will put us AT RISK from HACKERS
Knocking holes in Apple's walled garden could backfire, says securo-chap
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Top 5 reasons to deploy VMware with Tegile
Data demand and the rise of virtualization is challenging IT teams to deliver storage performance, scalability and capacity that can keep up, while maximizing efficiency.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.