A file named "ChromeSetup.exe" is being offered for download on various websites, the link appears to be legitimately hosted on Facebook and Google domains.
Once the malware is executed, it relays the IP address and operating system version to one of two command-and-control servers, then downloads a configuration file. The malware then intercepts any HTTP requests should the machine be used to make contact with a banking website - in such a scenario the user will face a pop up a dialog box informing the user that new security software will be installed.
Users are advised to ensure that their anti-virus software is up to date and to refrain from downloading software from unofficial sources.
0 comments:
Post a Comment