Hackers Use Fake NordVPN Website to Deliver Banking Trojan

[silversurfer]

Content source

https://www.bleepingcomputer.com/news/security/hackers-use-fake-nordvpn-website-to-deliver-banking-trojan/

The attackers who previously breached and abused the website of free multimedia editor VSDC to distribute the Win32.Bolik.2 banking Trojan have now switched their tactics.

While previously they hacked legitimate websites to hijack download links infected with malware, the hackers are now creating website clones to deliver banking Trojans onto unsuspecting victims' computers.

This allows them to focus on adding capabilities to their malicious tools instead of wasting time by trying to infiltrate the servers and websites of legitimate businesses.

More to the point, they are actively distributing the bank Win32.Bolik.2 banking Trojan via the nord-vpn[.]club website, an almost perfect clone of the official nordvpn.com site used by the popular NordVPN VPN service.

Read more below:

Hackers Use Fake NordVPN Website to Deliver Banking Trojan

The attackers who previously breached and abused the website of free multimedia editor VSDC to distribute the Win32.Bolik.2 banking Trojan have now switched their tactics.

www.bleepingcomputer.com

Banking trojan Bolik spreads disguised as the NordVPN app

Researchers at Doctor Web’s virus lab discovered a dangerous banking trojan, <a href="https://vms.drweb.com/search/?q=Win32.Bolik.2&lng=en"><b>Win32.Bolik.2</b></a>, being spread by hackers via fake websites of popular software. One of these resources is copied from a well-known VPN service...

news.drweb.com