Phemedrone Stealer Virus Can Steal Windows Users’ Confidential Data

We would like to warn you about the newest threat that has been detected recently, namely the Phemedrone Stealer virus. The virus targets infected devices, stealing sensitive data such as passwords and authentication cookies, which it then sends to malware operators. Trend Micro, a Cybersecurity expert, has provided a statement regarding this virus.

How Viruses Work

Name: Phemedrone
Detection: Trojan:MSIL/FormBook
Damage: Phemedrone is malicious software designed to collect system information, capture files, and steal data from web browsers and applications, including sensitive information such as passwords, credit card details, and crypto wallets.

This virus specifically looks for sensitive information stored in web browsers, crypto wallets, and messaging clients such as Telegram, Steam, and Discord. Additionally, this virus takes screenshots and creates a summary of hardware, location, and operating system data. The stolen information is then sent to a control server or sent via Telegram.

Exploiting Windows Defender SmartScreen Weaknesses

Phemedrone Stealer exploits the Windows Defender SmartScreen flaw listed as CVE-2023-36025 and rated 8.8 out of 10. To exploit this flaw, an attacker would have to create a URL file and force the victim to open it. Microsoft fixed this flaw in November 2023, but hackers continue to attack systems that have not received the appropriate updates.

“Public attention was drawn to demo versions and proof-of-concept code circulating on social networks explaining the functionality of CVE-2023-36025. Since details of this flaw first emerged, the number of malicious campaigns deploying Phemedrone Stealer payloads and incorporating this flaw into their attack chains has continued to increase,” Trend Micro explained.

Protective Measures

To protect yourself from this threat, the following steps can be taken:

1. Make sure your system is updated

Make sure your operating system and security software are always up to date. The latest security updates can protect you from vulnerabilities exploited by Phemedrone Stealer.

2. Be Aware of Accepted URL Files

Avoid opening suspicious or unknown URL files. Hackers often use this trick to exploit weaknesses in SmartScreen.

3. Use the Latest Security Software

Use up-to-date security software that can detect and remove threats such as Phemedrone Stealer. Make sure your security software is always updated.

Conclusion

Phemedrone Stealer virus is a serious threat that requires extra vigilance from Windows users. By understanding how they work and effective protection measures, we can reduce risks and protect our personal data from hacking. Stay alert and keep your security systems updated to keep your digital security safe.