Previously associated with the Arkei stealer (seen below), Overdot posts a majority of advertisements across multiple message boards, provides customer service via Jabber, and addresses buyer complaints in the reputational system used by several boards. Appearing first in January, Baldr quickly generated many positive reviews on most of the popular clearnet Russian hacking forums. Baldr on the marketД«aldr is likely the work of three threat actors: Agressor for distribution, Overdot for sales and promotion, and LordOdin for development. In this blog post, we will review the Baldr stealer which first appeared in underground forums in January 2019, and was later seen in the wild by Microsoft in February. On top of capturing browser history, stored passwords, and cookies, stealers will also look for files that may contain valuable data. This type of malware is popular among criminals and covers a greater surface than more specialized bankers.

Because such stealers are often non-resident (meaning they have no persistence mechanism) unless they are detected at the time of the attack, victims will be none-the-wiser that they have been compromised. This means that upon infection, the malware will collect all the data it needs and exfiltrate it right away. Unlike many banking Trojans that wait for the victim to log into their bankвЂ™s website, stealers typically operate in grab-and-go mode. Over the past few months, we have noticed increased activity and development of new stealers.

By William Tsing, Vasilios Hioureas, and JГ©rГґme Segura

Malwarebytes google chrome 2019