Quote:Security researchers from Zscaler have found a new remote access Trojan (RAT) for sale on the Dark Web that includes multiple functions and is able to spread via removable USB drives.
 
Dubbed Saefko, the backdoor remains in the background and executes every time a user logs in. The malware was designed to fetch Chrome browsing history for specific types of activities, send data to the command and control (C&C) server, and execute commands received from the C&C.
 
The RAT’s browsing history harvesting targets activities involving credit cards, business, social media, gaming, cryptocurrency, shopping, and the like. Upon receiving commands from the C&C, it can take screenshots, log keystrokes, record videos, and perform other actions as well, including downloading and executing additional payloads. 
 
Upon infection, the malware copies itself to two AppData directories, then also creates a startup key to ensure it is executed at each login (the key is different for accounts with administrative privileges), Zscaler reveals.