Multiple Infostealer Campaign

A new phishing campaign has been discovered, using cleverly disguised emails to deliver three different types of infostealer malware. These emails, which appear to be part of everyday business communication, trick recipients into downloading and running malicious files. Once executed, these files quietly steal sensitive information from the victim's system. Here’s a closer look at how each email operates and the malware it delivers.

AgentTesla: Disguised as a Payment Receipt

• Rating: ★★★★☆
• Date: 2024-09-30
• Objective: Malware
• Analyst: José Morim

The first phishing email is presented as a payment receipt, with a subject line and content indicating that a payment has been made. Attached is a file named "Payment-Advice.bat," which appears to be a harmless receipt document. However, this is actually a malicious executable designed to deliver AgentTesla, a well-known infostealer malware.
Once run, AgentTesla silently captures keystrokes, screenshots, and login credentials, sending them back to the attacker—all while the victim believes they are simply reviewing payment details.

FormBook: Masked as Shipping Documents

• Rating: ★★☆☆☆
• Date: 2024-10-01
• Objective: Malware
• Analyst: José Morim

The second phishing attempt comes in the form of a fake shipping notification.
The email claims that important shipping documents are attached and provides a file named “Shipping Documents,” which is an archive containing a malicious executable.
When opened, this executable installs FormBook, another infostealer that targets web forms and browsers, collecting sensitive data such as credit card details, login information, and more.
Victims think they are tracking a shipment, but in reality, they are unknowingly handing over their personal and financial information.

SnakeKeylogger: A Sophisticated Phishing Email from a Compromised Account

• Rating: ★★★★★
• Date: 2024-10-01
• Objective: Malware
• Analyst: José Morim

The third email is particularly convincing, as it originates from a legitimate, compromised corporate account. Well-written and professional, the email includes an attachment labeled “NOSSA CONSULTA REF...TA.pdf.r00”, which seems to be a PDF file containing a pricing table.
However, the file is an archive hiding a malicious executable.
Once the attachment is opened, SnakeKeylogger is deployed. This malware logs keystrokes and collects sensitive information, giving the attacker access to everything the victim types, including passwords and confidential business details.

This campaign highlights how attackers use familiar scenarios—payment receipts, shipping documents, and legitimate business correspondence—to trick victims into downloading malware.
To protect yourself, always be cautious when receiving unsolicited emails, especially those with attachments.
Double-check the sender’s email address, verify the legitimacy of the message, and avoid opening files or clicking links from unknown or unexpected sources.
By staying vigilant and aware of these tactics, you can prevent these infostealers from compromising your system and stealing your sensitive data.

Indicators of Compromise

Keep up with threat insights

Threat Insights is a weekly series where we present you with analysis from samples we collect.
Follow us on social media for the latest feed and cybersecurity content. Stay informed and stay safe!

---

Get more insights like this

• Follow us on social media to get a weekly update of our latest content, and don't worry—we won't spam your feed 😉
• Join our private beta and get a sneak peek of how your team will improve their security posture.