Threat Management, Malware, Network Security

Fake VPN and office software websites spread Bolij.2 banking trojan

Cybercriminals recently set up impostor websites for the NordVPN virtual private network service and two office software products, in an attempt to infect visitors with the Win32.Bolij.2 banking trojan, according to researchers.

Launched on Aug. 8, the fake NordVPN site, nord-vpn[.]club, has already drawn thousands of visitors so far this month, Dr.Web reports in an Aug. 19 company blog post. The site is very realistic, featuring the same over design, color schemes and fonts as the true site, And it even has a valid SSL certificate.

The fraudulent site attempts to coax visitors into downloading a program that comes bundled with Bolij2. Dr.Web researchers describe the trojan as an upgraded version of Win32.Bolik.1, noting it "has qualities of a multicomponent polymorphic file virus" and is "capable of performing web injections, traffic intercepts, keylogging and stealing information from different bank-client systems."

The attackers launched a similar plot last June when it copied the websites of Invoice 360 Enterprise and Crystal Office Systems, both of which make business/office applications. Dr.Web says this particular scheme delivered not only Bolij.2, but also Trojan.PWS.ZStealer.26645, otherwise known as the Predator the Thief information stealer.

Last April, Dr.Web reported that the same cybercriminal group compromised the website of video editing software VDSC and used its links to distribute Bolij.2 and KPOT Stealer malware. In these more recent campaigns, however, no website compromise was necessary, as the attackers simply created their own fake sites instead.

Bradley Barth

As director of multimedia content strategy at CyberRisk Alliance, Bradley Barth develops content for online conferences, webcasts, podcasts video/multimedia projects — often serving as moderator or host. For nearly six years, he wrote and reported for SC Media as deputy editor and, before that, senior reporter. He was previously a program executive with the tech-focused PR firm Voxus. Past journalistic experience includes stints as business editor at Executive Technology, a staff writer at New York Sportscene and a freelance journalist covering travel and entertainment. In his spare time, Bradley also writes screenplays.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.