Subscribe to our news Changelog
Fruity trojan downloader performs multi-stage infection of Windows computers
Doctor Web has uncovered an attack on Windows users involving a modular downloader trojan dubbed Trojan.Fruity.1. With its help, threat actors can infect computers with different types of malware, depending on the attackers’ goals. To conceal an attack and increase the chances of it being successful, they use a variety of tricks. These include a multi-stage infection process for target systems, using harmless apps for launching components of the trojan, and trying to bypass anti-virus protection.
27.07.2023 | About viruses
Doctor Web’s May 2023 review of virus activity on mobile devices
According to detection statistics collected by Dr.Web for Android, in May 2023, the activity of adware trojans from the Android.HiddenAds and Android.MobiDash families decreased by 9.04% and 6.3% respectively. At the same time, the number of spyware trojan attacks increased by 120.53%. Most often, users encountered Android.Spy.5106 , a spy built into some unofficial WhatsApp messenger mods. Compared to the previous month, the number of banking trojan attacks decreased by 55.33%, while the number of ransomware malware attacks decreased by 28.26%.
28.06.2023 | About viruses
Doctor Web’s May 2023 virus activity review
An analysis of Dr.Web May detection statistics revealed a 1.24% increase in the total number of threats detected on protected devices, compared to April. At the same time, the number of unique threats decreased by 8.25%. Users most often encountered adware software and trojan applications from various families. PDF documents used in phishing attacks were distributed on a massive scale in email traffic. Moreover, threat actors used email to spread malicious scripts and software that exploit Microsoft Office vulnerabilities.
28.06.2023 | About viruses
Doctor Web’s April 2023 virus activity review
An analysis of Dr.Web April detection statistics revealed a 2.08% decrease in the total number of threats detected on protected devices, compared to March. The number of unique threats also decreased—by 17.40%. Among them, adware and trojans from different families were again the most active. In email traffic, malicious scripts and PDF documents used in phishing attacks prevailed.
14.06.2023 | About viruses
Doctor Web’s April 2023 review of virus activity on mobile devices
According to detection statistics collected by Dr.Web for Android, in April 2023, users encountered Android.HiddenAds adware trojans 16.13% less often, but Android.MobiDash adware trojans 40.42% more often, than in March. At the same time, this type of Android malware remains one of the most common threats for the Android platform.
14.06.2023 | About viruses
Doctor Web identifies pirated Windows builds with crypto stealer that penetrates EFI partition
Doctor Web has discovered a malicious clipper program in a number of unofficial Windows 10 builds that cybercriminals have been distributing via a torrent tracker. Dubbed Trojan.Clipper.231, this trojan app substitutes crypto wallet addresses in the clipboard with addresses provided by attackers. As of this moment, malicious actors have managed to steal cryptocurrency in an amount equivalent to about $19,000 US.
13.06.2023 | About viruses
Android apps containing SpinOk module with spyware features installed over 421,000,000 times
Doctor Web discovered an Android software module with spyware functionality. It collects information on files stored on devices and is capable of transferring them to malicious actors. It can also substitute and upload clipboard contents to a remote server. Dubbed Android.Spy.SpinOk in accordance with Dr.Web classification, this module is distributed as a marketing SDK. Developers can embed it into all sorts of apps and games, including those available on Google Play.
29.05.2023 | About viruses
Doctor Web’s March 2023 review of virus activity on mobile devices
According to detection statistics collected by Dr.Web for Android, in March 2023, members of the Android.HiddenAds and Android.MobiDash trojan families continued to be among the most widespread Android threats. The activity of the former remained at the level of the previous month and increased by an insignificant 0.16%, while the latter attacked users 11.89% more often. Spyware trojans were detected 5.01% less frequently, and a significant portion of these was once again represented by different variants of a trojan hidden in some unofficial modifications of the WhatsApp messenger.
19.04.2023 | About viruses
Doctor Web’s February 2023 review of virus activity on mobile devices
According to the detection statistics collected by Dr.Web for Android, the activity of adware trojans from the Android.HiddenAds family increased by 26.95% in February, compared to the previous month. At the same time, the activity of adware trojans from the Android.MobiDash family decreased by 7.27%.
06.04.2023 | About viruses
Doctor Web’s February 2023 virus activity review
An analysis of Dr.Web February detection statistics revealed a 22.29% increase in the total number of threats observed on protected devices, compared to January. At the same time, the number of unique threats increased by 34.02%. Most often detected were all kinds of adware apps and trojans from different families. In email traffic, malicious scripts and applications that exploit vulnerabilities in Microsoft Office software were most commonly observed. In addition, phishing HTML files were actively distributed through email. These simulated the authentication process for popular websites in order to steal authentication data.
06.04.2023 | About viruses
Doctor Web’s annual virus activity review for 2022
In 2022, the most widespread threats were once again various malicious programs, and their attacks significantly increased in number, compared to 2021. Most often, users encountered trojan apps based on the AutoIt scripting language. Threat actors deployed them together with other threats in an attempt to prevent the latter from being detected. Users were also attacked by various downloaders and droppers. The former loaded and executed a payload on targeted computers, while the latter contained a malicious payload and extracted it once the targeted systems were infected. Also active were backdoors, which executed remote commands, and adware trojans.
29.03.2023 | About viruses
Doctor Web’s review of viArus activity on mobile devices in 2022
In 2022, cybercriminals were again mostly focused on making illegal profits. The online advertisement market remains the easiest and most efficient method for generating income. Consequently, as before, Android device users often encountered the types of malicious and unwanted apps that display unwelcome and intrusive ads. At the same time, Doctor Web observed high scammer activity and the resultant spread of all kinds of fraudulent applications.
16.03.2023 | About viruses
Doctor Web’s January 2023 review of virus activity on mobile devices
According to detection statistics collected by Dr.Web for Android, users started encountering adware trojans more often in January. The most widespread among them were once again members of the Android.HiddenAds trojan family, which were detected 18.04% more often than in December.
02.03.2023 | About viruses
Doctor Web’s January 2023 virus activity review
An analysis of Dr.Web January 2023 statistics revealed a 4.47% decrease in the total number of detected threats, compared to December of last year. In contrast, during the same period, the number of unique threats increased by 4.26%. Various adware remained the most active. In email traffic, malicious scripts and software that exploit diverse vulnerabilities were detected most often.
02.03.2023 | About viruses
«Доктор Веб»: огляд вірусної активності для мобільних пристроїв у листопаді 2021 року
09.12.2021 | About viruses
«Доктор Веб»: огляд вірусної активності в листопаді 2021 року
09.12.2021 | About viruses
«Доктор Веб»: огляд вірусної активності у жовтні 2021 року
29.11.2021 | About viruses
«Доктор Веб»: огляд вірусної активності для мобільних пристроїв у жовтні 2021 року
29.11.2021 | About viruses
«Доктор Веб»: огляд вірусної активності для мобільних пристроїв у вересні 2021 року
15.10.2021 | About viruses
«Доктор Веб»: обзор вирусной активности для мобильных устройств в августе 2021 года
08.09.2021 | About viruses
«Доктор Веб»: обзор вирусной активности в августе 2021 года
В августе анализ данных статистики Dr.Web показал увеличение общего числа обнаруженных угроз на 16.8% по сравнению с июлем. Количество уникальных угроз увеличилось на 5.6%. Большинство детектирований по-прежнему приходится на долю рекламных программ и нежелательных приложений. В почтовом трафике чаще всего распространяется разнообразное вредоносное ПО, в том числе в виде PDF-файлов.
08.09.2021 | About viruses
«Доктор Веб»: обзор вирусной активности в июле 2021 года
В июле анализ данных статистики Dr.Web показал увеличение общего числа обнаруженных угроз на 3.44% по сравнению с июнем. При этом количество уникальных угроз уменьшилось на 9.5%. Большинство детектирований по-прежнему приходится на долю рекламных программ и нежелательных приложений. В почтовом трафике по частоте распространения лидирует разнообразное вредоносное ПО, в том числе бэкдоры, направленные на хищение паролей.
11.08.2021 | About viruses
«Доктор Веб»: обзор вирусной активности для мобильных устройств в июле 2021 года
В июле вирусные аналитики компании «Доктор Веб» выявили очередные вредоносные приложения в каталоге Google Play. Среди них ― трояны семейства Android.Joker , подписывавшие жертв на платные мобильные услуги, а также программа-подделка семейства Android.FakeApp , которая заманивала российских пользователей на мошеннические сайты, предлагая им получить социальные выплаты от государства.
11.08.2021 | About viruses
Новый банковский троян Coper нацелен на пользователей из Колумбии
Компания «Доктор Веб» предупреждает о появлении нового семейства банковских троянов для Android-устройств, получившего имя Android.BankBot.Coper. Вредоносные программы этого семейства обладают модульной архитектурой и многоступенчатым механизмом заражения, а также набором защитных приемов, помогающих им противостоять своему удалению. Все это позволяет троянам дольше оставаться работоспособными и проводить более успешные атаки. Известные на данный момент модификации банкеров нацелены на колумбийских пользователей, однако со временем возможно появление версий, которые будут атаковать пользователей из других стран.
21.07.2021 | About viruses
О защите от проникновения через уязвимость Windows PrintNightmare
В связи с выявлением в июне критических уязвимостей диспетчера очереди печати Windows — CVE-2021-1675 и CVE-2021-34527 (известных под единым именем PrintNightmare) — компания «Доктор Веб» обращает внимание пользователей на необходимость соблюдения мер защиты. Несмотря на то, что Microsoft к настоящему времени закрыла уязвимости, CVE-2021-34527 продолжает представлять опасность, позволяя злоумышленникам проникнуть в систему и выполнить произвольный код c повышенными привилегиями (NT AUTHORITY\SYSTEM) в случае, если пользователь самостоятельно переключит определённые параметры в реестре Windows.
15.07.2021 | About viruses
