Most LokiBot Samples in the Wild are “Hijacked” Versions of the Original Malware

Hacker himself got hacked.

It turns out that most samples of the LokiBot malware being distributed in the wild are modified versions of the original sample, a security researcher has learned.

Targeting users since 2015, LokiBot is a password and cryptocoin-wallet stealer that can harvest credentials from a variety of popular web browsers, FTP, poker and email clients, as well as IT administration tools such as PuTTY.

The original LokiBot malware was developed and sold by online alias “lokistov,” a.k.a. “Carter,” on multiple underground hacking forums for up to $300, but later some other hackers on the dark web also started selling same malware for a lesser price (as low as $80).

images from Hacker News