Cybercriminals are flooding to use the Snake password-stealing trojan, making it one of the popular malware families used in attacks.
Snake has been active since November 2020 and is a different project from the ransomware operation that
used the same name in the past.
Written in .NET and using the same staging mechanism as
FormBook and Agent Tesla, researchers from
Cybereason take a deep dive into how the rising threat operates.
Wide range of malicious features
Cybercriminals currently sell Snake on dark web forums for as low as $25, which could be why we see a
spike in its deployment.
Mainly deployed in phishing campaigns, Snake installed via malicious email attachments or through drops sites reached by clicking on email links.
When installed on a computer, Snake is capable of stealing credentials from over 50 apps, including email clients, web browsers, and IM platforms.
Some of the more popular programs targeted by Snake include: ... ... ...