SteelFox Malware Exploits Vulnerable Driver to Hijack Windows PCs for Crypto Mining and Data Theft
The newly discovered SteelFox malware leverages a vulnerable driver to escalate privileges, enabling it to steal sensitive data and mine cryptocurrency on Windows machines. Distributed through cracked software on forums and torrent sites, SteelFox presents significant risks to users of popular programs like AutoCAD, JetBrains, and Foxit PDF Editor.
- Distribution Channels: SteelFox is spread via torrent trackers and online forums as cracked tools for legitimate software activation.
- Privilege Escalation: Uses the “bring your own vulnerable driver” method with WinRing0.sys to gain SYSTEM-level privileges.
- Multi-Faceted Attack: Combines cryptocurrency mining with data theft, targeting credit card data, browsing history, and other information.
- Browser Data Extraction: Retrieves sensitive details from 13 browsers, including saved credit card info and RDP connection data.
- Advanced Stealth: Hides command-and-control (C2) domain via Google Public DNS and DNS over HTTPS (DoH), making detection challenging.
- Global Reach: Primarily impacts users in Brazil, China, Russia, Mexico, and other regions, focusing on commonly cracked applications.
SteelFox is an advanced, multi-functional malware that combines cryptomining with data theft by exploiting a known vulnerability in Windows drivers. Users should exercise caution when downloading cracked software and maintain updated security solutions to defend against this rapidly spreading threat.
Comment(s)
Categories
- Other (42)
- Ransomware (127)
- Events and News (26)
- Features (45)
- Security (430)
- Tips (79)
- Google (22)
- Achievements (9)
- Products (33)
- Activation (7)
- Dealers (1)
- Bank Phishing (42)
- Malware Alerts (194)
- Cyber Attack (221)
- Data Backup (11)
- Data Breach (79)
- Phishing (139)
- Securty Tips (1)
- Browser Hijack (16)
- Adware (15)
- Email And Password (67)
- Android Security (56)
- Knoweldgebase (38)
- Botnet (15)
- Updates (3)
- Alert (70)
- Hacking (57)
- Social Media (7)
- vulnerability (54)
- Hacker (31)
- Spyware (8)
- Windows (6)
- Microsoft (21)
- Uber (1)
- YouTube (1)
- Trojan (2)
- Website hacks (3)
- Paytm (1)
- Credit card scam (1)
- Telegram (3)
- RAT (5)
- Bug (3)
- Twitter (2)
- Facebook (7)
- Banking Trojan (5)
- Mozilla (2)
- COVID-19 (5)
- Instagram (2)
- NPAV Announcement (5)
- IoT Security (1)
- Deals and Offers (1)
- Cloud Security (8)
- Offers (5)
- Gaming (1)
- FireFox (2)
- LinkedIn (2)
- WhatsApp (4)
- Amazon (1)
- DMart (1)
- Payment Risk (4)
- Occasion (2)
- firewall (1)
- Cloud malware (2)
- Cloud storage (2)
- Financial fraud (6)
- Impersonation phishing (1)
- DDoS (4)
- Smishing (2)
- Whale (0)
- Whale phishing (3)
- WINRAR (2)
- ZIP (2)
Recent Posts
Archive
Tags
cyber attack
phishing
data breach
ransomware
ransomeware
android malware
cyber security
financial security
malware
phishing attack
data stealing
ddos
critical vulnerability
cybercrime
trojan
twitter
cyber threat
financial fraud
phishing attacks
phishing email
microsoft
data theft
cert-in
lockbit
cyber threats
network security
india
clop gang
clop gang extorting
data security
user data leak
phishing scam
android
play store
whatsapp
clop
email phishing
pakistani hackers
cyber attack in india
independence day
cyber crime
malicious apps
december cyber attacks
phishing campaigns
server security
pakistan-backed hacker
android apps
cryptojacking
winrar
pune