New analysis of dark web forums shows an increase in discussions around the use of infostealer malware as part of both the first attack within a campaign or as part of an initial access attack.
We’ve known for quite some time that threat actors need credentials to be successful. It’s probably the only reason we’ve seen a 68% increase in phishing attacks solely focused on credential harvesting. But most phishing scams only take in a single credential (e.g., a Microsoft 365 account). And it makes sense that if a threat actor can take their victim for a larger number of accounts in a single attack, the actor is in a better position to either continue the attack, shift focus to the most profitable attack type, or sell the collected credentials.
Enter in the elevated interest in infostealer malware. Infostealers aren’t new; Qakbot, for example, has been around since 2007. But the marketplace for this type of malware has exploded. According to Accenture’s Cyber Threat Intelligence team in a recent post on information stealers on the dark web, the number of individual malware available for purchase is increasing:
Source: Accenture
This comes at a time when multi-factor authentication (MFA) Fatigue (also known as MFA Prompt Bombing) is on the rise, as attackers attempt to contend with more organizations implementing MFA. In concept, with infostealers in place, threat actors have more credentials, and with more orgs having MFA in place, prompt bombing will continue as a tactic.
Both of the juncture points between the threat actors and your users (the initial email designed to steal credentials and the MFA fatigue attack) can easily be mitigated with proper Security Awareness Training designed to educate the user about scams, campaigns, themes, social engineering tactics, and techniques used to trick them – all so the user themselves won’t fall for the malicious trickery.
