Malware hunters at SentinelOne on Thursday flagged a newly discovered Python-based hacking tool being used by cybercriminals to hijack cloud platforms and payment services. The tool, called FBot, is capable of credential harvesting for spamming attacks, AWS account hijacking and functions to enable attacks against PayPal and various SaaS accounts. According to documentation from the company’s SentinelLabs research unit, Fbot is characterized by a smaller footprint compared to similar tools, indicating possible private development and a more targeted distribution approach.
SentinelLabs researcher Alex Delamotte
dissected the internals of the attack tool and found features to target web servers and cloud services as well as Software-as-a-Service (SaaS) technologies that include Aws, Office365, PayPal, Sendgrid and Twilio. While the tool is primarily designed for actors to hijack cloud, SaaS, and web services, Delamotte discovered a secondary focus on obtaining accounts to conduct spamming attacks.
