Cybersecurity researchers are warning of two different information-stealing malware, named FFDroider and Lightning Stealer, that are capable of siphoning data and launching further attacks.
“Designed to send stolen credentials and cookies to a Command & Control server, FFDroider disguises itself on victim’s machines to look like the instant messaging application ‘Telegram,'” Zscaler ThreatLabz researchers Avinash Kumar and Niraj Shivtarkar said in a report published last week.
Information stealers are able to extract sensitive information from compromised computers, including keystrokes.
FFDroider can be distributed via cracked installers or freeware. It has the primary purpose of stealing credentials and cookies associated with social media platforms. The data is used to log into accounts and collect other account-related information.
Web browsers that are being targeted include Google Chrome and Mozilla Firefox. Internet Explorer is also affected. Microsoft Edge. The websites targeted encompass Facebook, Instagram, Twitter, Amazon, eBay, and Etsy.
“The stealer signs into victims’ social media platforms using stolen cookies, and extracts account information like Facebook Ads-manager to run malicious advertisements with stored payment methods and Instagram via API to steal personal information,” the researchers said.
FFDroider also comes with a downloader functionality to upgrade itself with new modules from an update server that allows it expand its feature set over time, enabling malicious actors to abuse the stolen data as a vector for initial access to a target.
 |
| Main Function of Lightning Stealer |
Lightning stealer operates in a similar fashion in that it can steal Discord tokens, data from cryptocurrency wallets, and details pertaining to cookies, passwords, credit cards, and search history from more than 30 Firefox and Chromium-based browsers, all of which is exfiltrated to a server in JSON format.
“Info Stealers are adopting new techniques to become more evasive,” Cyble researchers said, adding it “witnessed ransomware groups leveraging Info Stealers to gain initial network access and, eventually, exfiltrating sensitive data. “
The development comes as stealer malware is becoming an increasingly common occurrence across different attack campaigns in recent months, in part to fill the void left by Raccoon Stealer’s exit from the market in late March due to the ongoing war in Ukraine.
In February 2022, Cyble Research disclosed details of an emerging threat called Jester Stealer that’s engineered to steal and transmit login credentials, cookies, credit card information along with data from passwords managers, chat messengers, email clients, crypto wallets, and gaming apps to the attackers.
Since then, at least three different info-stealers have emerged in the wild, including BlackGuard, Mars Stealer, and META, the last of which has been observed delivered via malspam campaigns to collect sensitive data.
