A new phishing campaign is targeting Israeli organizations to deliver the RHADAMANTHYS information-stealing malware, Cyber Security News reports.
Security researcher Maor Dayan discovered the campaign, noting that the phishing emails impersonate the Israeli news organizations Calcalist and Mako.
The emails are written in Hebrew, informing the recipient of a copyright violation that needs to be addressed within 24 hours. The emails have malicious attachments disguised as legal documents, which will deliver the malware.
Dayan notes, “This approach exploits human psychology known as social engineering, playing on fears of legal troubles and time pressure to bypass the victim’s usual security considerations.”
Once installed, the malware will attempt to target the following information:
- “Web Browsers: Saved passwords, autofill data, browsing history
- Cryptocurrency: Wallet files and related data
- System Information: Detailed specs, installed software, running processes
- File System: Scans for documents with specific extensions (e.g., .doc, .pdf)
- Screenshots: Periodic captures of the victim’s desktop
- Keylogging: Captures keystrokes to steal additional credentials”
RHADAMANTHYS is a malware-as-a-service offering that’s being sold on underground forums. It’s used by several known cybercriminal groups, but can be deployed by any threat actor interested in stealing information. The motivation of this campaign is unclear, but its targeting suggests the possibility of geopolitical interests.
“RHADAMANTHYS represents a significant evolution in the realm of information stealers,” Dayan writes. “Its multi-stage infection process, robust anti-analysis features, and comprehensive data theft capabilities make it a formidable threat, particularly to users and organizations in Israel. As this malware family continues to evolve, it’s crucial for security professionals to stay informed about its tactics and implement layered defenses to mitigate the risk.”
KnowBe4 empowers your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
Cyber Security News has the story.
