Submitted via IRC for SoyCow2718
The attackers who previously breached and abused the website of free multimedia editor VSDC to distribute the Win32.Bolik.2 banking Trojan have now switched their tactics.
While previously they hacked legitimate websites to hijack download links infected with malware, the hackers are now creating website clones to deliver banking Trojans onto unsuspecting victims' computers. This allows them to focus on adding capabilities to their malicious tools instead of wasting time by trying to infiltrate the servers and websites of legitimate businesses.
More to the point, they are actively distributing the bank Win32.Bolik.2 banking Trojan via the nord-vpn[.]club website, an almost perfect clone of the official nordvpn.com site used by the popular NordVPN VPN service. The cloned website also has a valid SSL certificate issued by open certificate authority Let’s Encrypt on August 3, with an expiration date of November 1.
"Win32.Bolik.2 trojan is an improved version of Win32.Bolik.1 and has qualities of a multicomponent polymorphic file virus," state the Doctor Web researchers who spotted the campaign.
"Using this malware, hackers can perform web injections, traffic intercepts, keylogging and steal information from different bank-client systems."
The operators behind this malicious campaign have launched their attacks on August 8, they are focusing on English-speaking targets and, according to the researchers, thousands have already visited the nord-vpn[.]club website in search of a download link for the NordVPN client.
(Score: 3, Disagree) by ikanreed on Wednesday August 21 2019, @06:34PM (4 children)
Make everyone type urls by hand. No more links. Too easy. Enables too many dumb people on the internet.
If you're googling for google, sorry, no internet for you.
(Score: 0) by Anonymous Coward on Wednesday August 21 2019, @08:20PM (1 child)
Dude, that is really gonna f-up the tracking that uses all the extra garbage in URLs.
(Score: 0) by Anonymous Coward on Thursday August 22 2019, @08:05PM
You mean like https://soylentnews.org/comments.pl?cid=874527&sid=32908 [soylentnews.org]
(Score: 1, Interesting) by Anonymous Coward on Wednesday August 21 2019, @08:37PM (1 child)
hashify [hashify.me]
"Hashify does not solve a problem, it poses a question: what becomes possible when one is able to store entire documents in URLs?"
(Score: 0) by Anonymous Coward on Thursday August 22 2019, @01:36PM
LOL, unfortunately this joke doesn't follow through:
The URL length was 2001 characters, so while it was kinda funny, it left me sad once I checked it.