Researchers have discovered a previously unknown remote access trojan called InnfiRAT, capable of data ex-filtration and digital spying.
InnfiRAT searches for users’ cryptocurrency wallet information (bitcoin and Litecoin included) and steals browser cookie data in order to obtain victims’ usernames, passwords, and session data. This information is then sent to a malicious command-and-control server,Zscaler researchers
Written in .NET, the RAT also takes secret screenshots to capture any sensitive information that may be displayed on a user’s screen at a given time.
To avoid detection, InnfiRAT looks out for virtual machine environments and can also check for antivirus programs.
Additional technical details on InnfiRAT can be found in the blog post
