We have been made aware of a type of malware called ‘The Vega Stealer Malware’, which is a variant of the ‘August Stealer’ malware. This threat contains a credential stealing functionality which is targeting saved login credentials and credit card details which have been specifically stored in Chrome. The malware is spread via email attachments that contain a word, excel or pdf document with malicious macros embedded within that downloads payload.
Name of Exploit
The Vega Stealer Malware
Type of Exploit
Malware, Credential theft, Exfiltration of data (specifically documents), Credit card credential capture
How Exploit is Spread
The malware is spread via email attachments that contain a word, excel or pdf document with malicious macros embedded within that downloads payload. When the document is opened by the user the macro executes, a payload, which is saved to the victim’s machine in the “Music” directory with a filename of “ljoyoxu[.]pkzip”. The malware is spreading via specific mailing lists.
Global Risk
Low – the strain of Malware has only been observed attacking specific mail lists. The details of the mailing list are set for a very narrow set of companies, specifically within the following industries: Marketing/Advertising/Public Relations and Retail industries. We have not been able to comment on why it is only targeting these industries only.
