Procedure examples

IronNetInjector has the ability to decrypt embedded .NET and PE payloads.

Expand can be used to decompress a local or remote CAB file into an executable.

TeamPCP Cloud Stealer can deobfuscate an encoded Python script prior to execution.

Mini Shai-Hulud has the ability to decrypt obfuscated payloads.

CanisterWorm has decoded a long Base64 string to obtain a Python script for its second-stage payload.

BADFLICK can decode shellcode using a custom rotating XOR cipher.

TRANSLATEXT has the ability to capture credentials, cookies, browser screenshots, etc. and to exfiltrate data.

Mispadu utilizes malicious Google Chrome browser extensions to steal financial data.

Lumma Stealer has installed a malicious browser extension to target Google Chrome, Microsoft Edge, Opera and Brave browsers for the purpose of stealing data.

Bundlore can install malicious browser extensions that are used to hijack user searches.

Grandoreiro can use malicious browser extensions to steal cookies and other user information.

OSX/Shlayer can install malicious Safari browser extensions to serve ads.

TrickBot uses web injects and browser redirection to trick the user into providing their login credentials on a fake or modified web page.

Ursnif has injected HTML codes into banking sites to steal sensitive online banking information (ex: usernames and passwords).

TRANSLATEXT has the ability to use form-grabbing and event-listening to extract data from web data forms.

IcedID has used web injection attacks to redirect victims to spoofed sites designed to harvest banking and other credentials. IcedID can use a self signed TLS certificate in connection with the spoofed site and simultaneously maintains a live connection with the legitimate site to display the correct URL and certificates in the browser.

Chaes has used the Puppeteer module to hook and monitor the Chrome web browser to collect user information from infected hosts.

Grandoreiro can monitor browser activity for online banking actions and display full-screen overlay images to block user access to the intended site or present additional data fields.

XLoader can conduct form grabbing, steal cookies, and extract data from HTTP sessions.

Cobalt Strike can perform browser pivoting and inject into a user's browser to inherit cookies, authenticated HTTP sessions, and client SSL certificates.

Carberp has captured credentials when a user performs login through a SSL session.

Melcoz can monitor the victim's browser for online banking sessions and display an overlay window to manipulate the session in the background.

Agent Tesla has the ability to use form-grabbing to extract data from web data forms.

QakBot can use advanced web injects to steal web banking credentials.

Dridex can perform browser attacks via web injects to steal information such as credentials, certificates, and cookies.

evilginx2 can inject custom POST arguments into requests to silently enable "Remember Me" options during authentication to stay logged in across browser sessions.

Kali365 has gathered browser session information and allows affiliate threat actors to replay stolen browser sessions within their own environment.

EnvyScout can use protocol handlers to coax the operating system to send NTLMv2 authentication responses to attacker-controlled infrastructure.

Bad Rabbit spread through watering holes on popular sites by injecting JavaScript into the HTML body or a .js file.

KARAE was distributed through torrent file-sharing websites to South Korean victims, using a YouTube video downloader application as a lure.

Snip3 has been delivered to targets via downloads from malicious domains.

IcedID has cloned legitimate websites/applications to distribute the malware.

POORAIM has been delivered through compromised sites acting as watering holes.

SocGholish has been distributed through compromised websites with malicious content often masquerading as browser updates.

Bundlore has been spread through malicious advertisements on websites.

Grandoreiro has used compromised websites and Google Ads to bait victims into downloading its installer.

REvil has infected victim machines through compromised websites and exploit kits.

LoudMiner is typically bundled with pirated copies of Virtual Studio Technology (VST) for Windows and macOS.

COATHANGER is installed following exploitation of a vulnerable FortiGate device.

BOLDMOVE is associated with exploitation of CVE-2022-49475 in FortiOS.

Siloscape is executed after the attacker gains initial access to a Windows container using a known vulnerability.

ZxShell has been dropped through exploitation of CVE-2011-2462, CVE-2013-3163, and CVE-2014-0322.

Qilin has been delivered through exploitation of exposed applications and interfaces including Citrix and RDP.

SoreFang can gain access by exploiting a Sangfor SSL VPN vulnerability that allows for the placement and delivery of malicious update binaries.

sqlmap can be used to automate exploitation of SQL injection vulnerabilities.

Havij is used to automate SQL injection.

Lumma Stealer has been delivered through cracked software downloads.

Raccoon Stealer has been distributed through cracked software downloads.

Tsundere Botnet has used the Node Package Manager (npm) to download malicious packages and to deliver the payload.

BeaverTail has been hosted on code repositories and disseminated to victims through NPM packages.