To obtain the final malware, the PowerShell script is executed by the PDF after it has downloaded a.NET executable file made with PowerGUI. Credentials, system data, browser sessions, and cryptocurrency extensions were all stolen by Mr. Alan Stealer.
According to FortiGuard Labs, this malware is a Python-based information stealer that has been compressed with cx-Freeze to avoid detection.
The majority of queries to the downloader URL came from Germany, indicating that the country was the attack's main target.
November 2023 had a notable increase in the number of inquiries for this URL, suggesting a more vigorous and active marketing during that month.
Researchers say a downloader link for the malicious PDF file is concealed in the stream object.
MrAnon Stealer's support channel offers more features, advertises the product, and has a page where users can buy all related tools.
Data and sensitive information are stolen from many applications, compressed, and uploaded to the threat actor's Telegram channel and a public file-sharing website.
As a result, users are cautioned to avoid opening suspicious PDF files and phishing emails.
This Cyber News was published on gbhackers.com. Publication date: Mon, 11 Dec 2023 13:28:05 +0000