Skype

A new variant of the LodaRAT malware is targeting Windows users globally to steal sensitive information, including login credentials and browser cookies. Discovered by Rapid7, this updated version has enhanced functionalities for data exfiltration, malware delivery, screen capture, and remote control of the victim's camera and mouse. The malware is being distributed through tools like DonutLoader and CobaltStrike and has been found on systems already infected with other malware families. Victims are reported worldwide, with approximately 30% of samples from the United States. LodaRAT ensures persistence on infected systems by adding entries to the Windows registry, creating scheduled tasks, and disguising itself as legitimate software. It conducts reconnaissance to gather system information, which is sent to a command and control server. Key features of the latest version include downloading additional payloads, remote command execution, mouse and keyboard control, screen capture, browser credential theft, Windows Firewall manipulation, file exfiltration, audio recording, and local user account creation. To mitigate the risk of infections, users are advised to keep software updated, implement email filtering, use antivirus solutions, educate employees on phishing risks, back up data, and monitor for unusual activity.