Researchers have discovered a previously unknown remote access trojan called InnfiRAT, capable of data exfiltration and digital spying.
InnfiRAT searches for users' cryptocurrency wallet information (Bitcoin and Litecoin included), and steals browser cookie data in order to obtain victims' usernames, passwords and session data. This information is then sent to a malicious command-and-control server, explain Zscaler researchers Sahil Antil and Rohit Chadurvedi in a company blog post published yesterday.
Written in .NET, the RAT also takes secret screenshots to capture any sensitive information that may be displayed on a user's screen at a given time.
To avoid detection, InnfiRAT looks out for virtual machine environments and can also check for antivirus programs.
Additional technical details on InnfiRAT can be found in the blog post.
