A new malware has been identified by cybersecurity researchers, and it is capable of many information gathering techniques like screen capture, audio capture, remote shell (which permits the threat actor to launch further attacks), keylogging and file transfer and execution. It’s called PLAYFULGHOST and it’s known to be delivered via phishing or SEO poisoning techniques that then distribute trojanized VPN apps.
Capable of setting up persistence on the host in four different manners (run registry key, scheduled task, Windows Startup folder and Windows service), the feature set in the PLAYFULGHOST malware allows it to gather an extensive set of data. Including keystrokes and screenshots; it can also collect audio, QQ account information, installed security products, clipboard content and system metadata.
