Organizations in Italy are the target of a new phishing campaign that leverages a new strain of malware called
WikiLoader with an ultimate aim to install a banking trojan, stealer, and spyware called
Ursnif (aka Gozi).
"It is a sophisticated downloader with the objective of installing a second malware payload," Proofpoint
said in a technical report. "The malware uses multiple mechanisms to evade detection and was likely developed as a malware that can be rented out to select cybercriminal threat actors."
WikiLoader is so named due to the malware making a request to Wikipedia and checking that the response has the string "The Free."
The enterprise security firm said it first detected the malware in the wild on December 27, 2022, in connection with an intrusion set mounted by a threat actor it tracks as
TA544, which is also known as Bamboo Spider and Zeus Panda.
The campaigns are centered around the use of emails containing either Microsoft Excel, Microsoft OneNote, or PDF attachments that act as a lure to deploy the downloader, which is subsequently used to install Ursnif.
