Loki Password Stealer (PWS)
Loki Password Stealer (PWS) is a type of malware designed to extract sensitive information, such as passwords and credentials, from infected systems. It primarily targets Windows operating systems and is known for its ability to steal data from web browsers, email clients, and other applications. Loki PWS is often sold on underground forums, making it accessible to various threat actors. As of October 2023, it remains a significant threat due to its continuous evolution and adaptability to new security measures.
Overview
Loki Password Stealer (PWS) is a malicious software program that focuses on extracting sensitive information from compromised systems. It is classified as a stealer, a type of malware that collects data such as passwords, cookies, and other credentials. Loki PWS is particularly effective against Windows operating systems and targets applications like web browsers and email clients. The malware is frequently updated and sold on underground forums, contributing to its widespread use among cybercriminals.
History
Loki PWS first appeared in the cyber threat landscape in 2015. Initially, it was a relatively simple tool, but over time, it has evolved into a more sophisticated malware. Its development is attributed to various threat actors who have continuously updated its features to bypass security measures. The malware's source code has been sold and shared in underground forums, to multiple variants and widespread distribution.
Technical characteristics
Loki PWS is designed to operate stealthily on infected systems. It typically uses a combination of techniques to evade detection, such as obfuscation and anti-analysis features. The malware targets a wide range of applications, including web browsers, email clients, and FTP clients, to extract stored credentials. It can also capture keystrokes and take screenshots, further enhancing its data-gathering capabilities.
The malware communicates with its command-and-control (C2) server to exfiltrate stolen data. This communication is often encrypted to avoid detection by security tools. Loki PWS is modular, allowing threat actors to customize its functionality according to their needs.
Infection vector
Loki PWS is primarily distributed through phishing emails, malicious attachments, and compromised websites. Phishing emails often contain attachments or links that, when opened, download and execute the malware on the victim's system. Compromised websites may host exploit kits that deliver the malware through drive-by downloads. Additionally, Loki PWS can be bundled with other software, making it more challenging for users to identify the threat.
Notable campaigns
Loki PWS has been involved in several notable campaigns targeting various sectors, including finance, healthcare, and retail. These campaigns often involve large-scale phishing attacks designed to distribute the malware to as many victims as possible. The malware's adaptability and ease of use have made it a popular choice among cybercriminals, to its involvement in numerous cyberattacks worldwide.
Detection and mitigation
Detecting Loki PWS can be challenging due to its stealthy nature and use of obfuscation techniques. However, security tools can identify the malware by analyzing network traffic for unusual patterns or by detecting known signatures associated with Loki PWS.
Mitigation strategies include educating users about phishing attacks, implementing robust email filtering solutions, and keeping software up to date to prevent exploitation. Organizations should also employ endpoint protection solutions capable of detecting and blocking malware like Loki PWS. Regularly backing up data and employing multi-factor authentication can further reduce the risk of credential theft.
History of Loki Password Stealer (PWS)
Loki PWS Operation Flow
See also
- lightning stealer
- laturo stealer
- lalala stealer
- kpot stealer
- koi stealer
- kleptoparasite stealer
- kematian stealer
- katz stealer
- isr stealer
- immortal stealer