Cred-stealing trojan harvests logins from Chromium browsers, Outlook and more, warns Cisco Talos

Cisco Talos has uncovered a credential-stealing trojan that lifts your login details from the Chrome browser, Microsoft's Outlook and instant messengers. Delivered through phishing emails, the Masslogger trojan’s latest variant is contained within a multi-volume RAR archive using the .chm file format and .r00 extensions, said …

[Pascal Monett]

And bingo !

“CHM is a compiled HTML file that contains an embedded HTML file with JavaScript code to start the active infection process. "

Javascript, again.

Block it, and the install process fails.

NoScript FTW !

[Mike 137]

Re: And bingo !

Which is why the UK National Cyber Security Centre web site is entirely a javascript app - you can't even see emergency contact details unless scripting is enabled.

I spoke to them about this, but they weren't interested.

[ThatOne]

Re: And bingo !

Seriously, what's security compared to coolness and programming street cred?

Besides, their goal isn't to be secure, but to be paid for it.

[David 132]

Re: And bingo !

More likely, they haven’t found that particular option in their copy of MS FrontPage yet.

[druck]

Re: And bingo !

Unfortunately NoScript isn't available for Microsoft Help, which is what loads/runs .chm files.

[Version 1.0]

It's not just Javascript

I see malware deliveries every day, all of them are quarantined by the mail server if they contain any of the files listed. But the majority of malware attempts these days seems to be delivered via Excel files containing macros. They are quarantined and I delete them after checking the spam score and source.

[Anonymous Coward]

No way out

You can harden hardware and software, and you should.

You can bury Javascript with a stake through its heart, and you should.

But, ultimately and unfortunately you can't avoid the wetware that insists on clicking the shiny button.

[FlamingDeath]

Re: No way out

A bit like an employee trying to set their company mailbox password to company name and appended numbers

We dont let people in control of dangerous machines, cars, without a license. A computer is far more dangerous vehicle