{"id":50100,"date":"2016-06-02T16:27:08","date_gmt":"2016-06-02T23:27:08","guid":{"rendered":"https:\/\/blogs.mcafee.com\/?p=50100"},"modified":"2025-06-06T02:14:38","modified_gmt":"2025-06-06T09:14:38","slug":"trillium-exploit-kit-update-offers-security-tips","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-exploit-kit-update-offers-security-tips\/","title":{"rendered":"Trillium Exploit Kit Update Offers &#8216;Security Tips&#8217;"},"content":{"rendered":"<p>McAfee Labs has previously blogged about the\u00a0<a href=\"https:\/\/securingtomorrow.mcafee.com\/mcafee-labs\/trillium-toolkit-leads-widespread-malware\/\">Trillium Exploit Kit Version 3.0<\/a>, which is commonly used to create and distribute malware. Last week, Version 4.0 appeared on several underground forums.<\/p>\n<p>We have analyzed the new version of the tool and it contains new functionality. These include:<\/p>\n<ul>\n<li>PDF downloader<\/li>\n<li>Password generator<\/li>\n<li>Security tips<\/li>\n<\/ul>\n<h2><strong>PDF downloader<\/strong><\/h2>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-50104\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/od_2305_004.jpg\" alt=\"od_2305_004\" width=\"863\" height=\"543\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od_2305_004.jpg 863w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od_2305_004-300x189.jpg 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od_2305_004-768x483.jpg 768w\" sizes=\"auto, (max-width: 863px) 100vw, 863px\" \/><\/p>\n<p>The user has several options when creating a PDF downloader, though all of these options create very similar PDF files.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-50102\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/od_2305_005.jpg\" alt=\"od_2305_005\" width=\"1087\" height=\"771\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od_2305_005.jpg 1087w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od_2305_005-300x213.jpg 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od_2305_005-768x545.jpg 768w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od_2305_005-1024x726.jpg 1024w\" sizes=\"auto, (max-width: 1087px) 100vw, 1087px\" \/><\/p>\n<p>Upon opening the file with\u00a0our\u00a0<a href=\"https:\/\/www.mcafee.com\/uk\/downloads\/free-tools\/fileinsight.aspx\">FileInsight tool,<\/a>\u00a0we can clearly see the\u00a0PDF using the OpenAction function to invoke PowerShell, which will download and execute a file.<\/p>\n<h2><strong>Password generator<\/strong><\/h2>\n<p>A strange addition to the toolkit is a password-generating component.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-50106\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/od_2305_006.jpg\" alt=\"od_2305_006\" width=\"866\" height=\"545\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od_2305_006.jpg 866w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od_2305_006-300x189.jpg 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od_2305_006-768x483.jpg 768w\" sizes=\"auto, (max-width: 866px) 100vw, 866px\" \/><\/p>\n<p>This will create a randomly generated string to be\u00a0used as a password for any account. Users can save this password on their machines. Upon clicking the button, a text file is created that\u00a0contains a clear-text unencrypted copy of the password.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-50107\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/od_2305_007.jpg\" alt=\"od_2305_007\" width=\"75\" height=\"84\" \/><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-50108\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/od_2305_008.jpg\" alt=\"od_2305_008\" width=\"343\" height=\"153\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od_2305_008.jpg 343w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od_2305_008-300x134.jpg 300w\" sizes=\"auto, (max-width: 343px) 100vw, 343px\" \/><\/p>\n<p>This is not very\u00a0secure.<\/p>\n<h2><strong>Security tips<\/strong><\/h2>\n<p>The oddest addition to Trillium is the inclusion of several security tips to help users avoid malware infections. We find this ironic because\u00a0the purpose of the software is to breach the security of user environments.<\/p>\n<p>There are various tips on antiphishing, downloading, uninstalling vulnerable software, and password use.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-50109\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/od_2305_015.jpg\" alt=\"od_2305_015\" width=\"587\" height=\"168\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od_2305_015.jpg 587w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od_2305_015-300x86.jpg 300w\" sizes=\"auto, (max-width: 587px) 100vw, 587px\" \/><\/p>\n<h2><strong>In use<\/strong><\/h2>\n<p>We have seen this toolkit used in the wild to target a bank in the Asia-Pacific region. This email contains a malicious PowerPoint file.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-50110\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/od_2305_009.jpg\" alt=\"od_2305_009\" width=\"628\" height=\"548\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od_2305_009.jpg 628w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od_2305_009-300x262.jpg 300w\" sizes=\"auto, (max-width: 628px) 100vw, 628px\" \/><\/p>\n<p>The attachment is a .PPSX file, a PowerPoint Show file starts the app in slideshow mode. This trick has been used many times to mask what is happening in the background.<\/p>\n<p>The .PPSX file contains an embedded VBS.Downloader Trojan\u00a0created using the Trillium 4.0 toolkit. A feature in PowerPoint can execute embedded OLE objects; the attacker has taken advantage of this by creating a custom action to execute the embedded VBS.Downloader when the PowerPoint slide is opened. <a href=\"https:\/\/support.office.com\/en-us\/article\/Apply-custom-and-advanced-animation-effects-d5a33677-6c06-430c-b6f1-ee7124bfce46\">(Click here<\/a>\u00a0for more information on\u00a0the custom animation feature.)<\/p>\n<figure id=\"attachment_50112\" aria-describedby=\"caption-attachment-50112\" style=\"width: 1060px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-50112 size-full\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/od_2305_014.jpg\" width=\"1060\" height=\"326\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od_2305_014.jpg 1060w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od_2305_014-300x92.jpg 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od_2305_014-768x236.jpg 768w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od_2305_014-1024x315.jpg 1024w\" sizes=\"auto, (max-width: 1060px) 100vw, 1060px\" \/><figcaption id=\"caption-attachment-50112\" class=\"wp-caption-text\">Customer animation feature used to execute the embedded VBS file.<\/figcaption><\/figure>\n<p>&nbsp;<\/p>\n<figure id=\"attachment_50111\" aria-describedby=\"caption-attachment-50111\" style=\"width: 728px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-50111 size-full\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/od_2305_011.jpg\" alt=\"od_2305_011\" width=\"728\" height=\"337\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od_2305_011.jpg 728w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od_2305_011-300x139.jpg 300w\" sizes=\"auto, (max-width: 728px) 100vw, 728px\" \/><figcaption id=\"caption-attachment-50111\" class=\"wp-caption-text\">VBS.Downloader Trojan created by Trillium 4.0.<\/figcaption><\/figure>\n<p>The VBS file downloads a password-stealing Trojan that\u00a0targets the following software:<\/p>\n<ul>\n<li>FireFox<\/li>\n<li>ThunderBird<\/li>\n<li>SeaMonkey<\/li>\n<li>Opera<\/li>\n<li>Outlook<\/li>\n<li>Pidgin<\/li>\n<\/ul>\n<p>The password stealer has\u00a0keylogging functionality and will create a log file in the %APPDATA%\\LOGS folder in the format DD-MM-YYYY. The malware\u00a0encrypts these log files with XOR 0x9D and then adds 0x24. In order to decrypt these, we need to reverse this algorithm. So we sub 0x24 and then XOR this with 0x9D.<\/p>\n<figure id=\"attachment_50161\" aria-describedby=\"caption-attachment-50161\" style=\"width: 736px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-50161 size-full\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/od_2305_020.jpg\" alt=\"od_2305_020\" width=\"736\" height=\"186\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od_2305_020.jpg 736w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od_2305_020-300x76.jpg 300w\" sizes=\"auto, (max-width: 736px) 100vw, 736px\" \/><figcaption id=\"caption-attachment-50161\" class=\"wp-caption-text\">Encrypted log file.<\/figcaption><\/figure>\n<p>&nbsp;<\/p>\n<figure id=\"attachment_50160\" aria-describedby=\"caption-attachment-50160\" style=\"width: 737px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-50160 size-full\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/od_2305_019.jpg\" alt=\"od_2305_019\" width=\"737\" height=\"223\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od_2305_019.jpg 737w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od_2305_019-300x91.jpg 300w\" sizes=\"auto, (max-width: 737px) 100vw, 737px\" \/><figcaption id=\"caption-attachment-50160\" class=\"wp-caption-text\">Decrypted log file.<\/figcaption><\/figure>\n<p>The malware attempts to contact the following servers:<\/p>\n<ul>\n<li>adzone.duia.eu<\/li>\n<li>adzone.ddns.net<\/li>\n<li>adzone.zzzz.io<\/li>\n<\/ul>\n<p>McAfee has\u00a0the following signatures for the Trillium malware:<\/p>\n<ul>\n<li>W97M\/Downloader.bdu<\/li>\n<li>Trojan-FISA<\/li>\n<li>Downloader-FBEF<\/li>\n<\/ul>\n<p>We recommend that our customers read\u00a0<a href=\"https:\/\/securingtomorrow.mcafee.com\/mcafee-labs\/best-practices-for-preventing-dridex-infections-2\/\">this post on best practices<\/a>. The advice\u00a0should help\u00a0mitigate some of the infections seen by malware created by this toolkit.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>McAfee Labs has previously blogged about the\u00a0Trillium Exploit Kit Version 3.0, which is commonly used to create and distribute malware&#8230;.<\/p>\n","protected":false},"author":774,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[442],"tags":[76,3923,3952,180],"coauthors":[849,854],"class_list":["post-50100","post","type-post","status-publish","format-standard","hentry","category-mcafee-labs","tag-cybercrime","tag-email-and-web-security","tag-internet-security","tag-malware"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v25.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Trillium Exploit Kit Update Offers &#039;Security Tips&#039; | McAfee Blog<\/title>\n<meta name=\"description\" content=\"McAfee Labs has previously blogged about the\u00a0Trillium Exploit Kit Version 3.0, which is commonly used to create and distribute malware. Last week, Version\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Trillium Exploit Kit Update Offers &#039;Security Tips&#039; | McAfee Blog\" \/>\n<meta property=\"og:description\" content=\"McAfee Labs has previously blogged about the\u00a0Trillium Exploit Kit Version 3.0, which is commonly used to create and distribute malware. Last week, Version\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-exploit-kit-update-offers-security-tips\/\" \/>\n<meta property=\"og:site_name\" content=\"McAfee Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:published_time\" content=\"2016-06-02T23:27:08+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-06-06T09:14:38+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od_2305_004.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"863\" \/>\n\t<meta property=\"og:image:height\" content=\"543\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Oliver Devane, Mohinder Gill\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@McAfee\" \/>\n<meta name=\"twitter:site\" content=\"@McAfee\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Oliver Devane, Mohinder Gill\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-exploit-kit-update-offers-security-tips\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-exploit-kit-update-offers-security-tips\/\"},\"author\":{\"name\":\"Oliver Devane\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/f3e79f95122a1e56c0b07811a4f2188a\"},\"headline\":\"Trillium Exploit Kit Update Offers &#8216;Security Tips&#8217;\",\"datePublished\":\"2016-06-02T23:27:08+00:00\",\"dateModified\":\"2025-06-06T09:14:38+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-exploit-kit-update-offers-security-tips\/\"},\"wordCount\":517,\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-exploit-kit-update-offers-security-tips\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/od_2305_004.jpg\",\"keywords\":[\"cybercrime\",\"email and web security\",\"internet security\",\"malware\"],\"articleSection\":[\"McAfee Labs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-exploit-kit-update-offers-security-tips\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-exploit-kit-update-offers-security-tips\/\",\"name\":\"Trillium Exploit Kit Update Offers 'Security Tips' | McAfee Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-exploit-kit-update-offers-security-tips\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-exploit-kit-update-offers-security-tips\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/od_2305_004.jpg\",\"datePublished\":\"2016-06-02T23:27:08+00:00\",\"dateModified\":\"2025-06-06T09:14:38+00:00\",\"description\":\"McAfee Labs has previously blogged about the\u00a0Trillium Exploit Kit Version 3.0, which is commonly used to create and distribute malware. Last week, Version\",\"breadcrumb\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-exploit-kit-update-offers-security-tips\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-exploit-kit-update-offers-security-tips\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-exploit-kit-update-offers-security-tips\/#primaryimage\",\"url\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/od_2305_004.jpg\",\"contentUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/od_2305_004.jpg\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-exploit-kit-update-offers-security-tips\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Other Blogs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"McAfee Labs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Trillium Exploit Kit Update Offers &#8216;Security Tips&#8217;\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"name\":\"McAfee Blog\",\"description\":\"Internet Security News\",\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\",\"name\":\"McAfee\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"width\":1286,\"height\":336,\"caption\":\"McAfee\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.youtube.com\/McAfee\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/f3e79f95122a1e56c0b07811a4f2188a\",\"name\":\"Oliver Devane\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/145287b0eca301fc80d99baf060dd274\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/Oliver-Devane-96x96.jpg\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/Oliver-Devane-96x96.jpg\",\"caption\":\"Oliver Devane\"},\"description\":\"Oliver Devane is currently a Senior Security Researcher at McAfee. He is based in the UK office and has over 10 years of experience analyzing Malware and Potentially Unwanted Programs.\",\"sameAs\":[\"https:\/\/www.linkedin.com\/in\/oliver-devane-1a528749\/\"],\"url\":\"https:\/\/www.mcafee.com\/blogs\/author\/oliver-devane\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Trillium Exploit Kit Update Offers 'Security Tips' | McAfee Blog","description":"McAfee Labs has previously blogged about the\u00a0Trillium Exploit Kit Version 3.0, which is commonly used to create and distribute malware. Last week, Version","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"Trillium Exploit Kit Update Offers 'Security Tips' | McAfee Blog","og_description":"McAfee Labs has previously blogged about the\u00a0Trillium Exploit Kit Version 3.0, which is commonly used to create and distribute malware. Last week, Version","og_url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-exploit-kit-update-offers-security-tips\/","og_site_name":"McAfee Blog","article_publisher":"https:\/\/www.facebook.com\/McAfee\/","article_published_time":"2016-06-02T23:27:08+00:00","article_modified_time":"2025-06-06T09:14:38+00:00","og_image":[{"width":863,"height":543,"url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od_2305_004.jpg","type":"image\/jpeg"}],"author":"Oliver Devane, Mohinder Gill","twitter_card":"summary_large_image","twitter_creator":"@McAfee","twitter_site":"@McAfee","twitter_misc":{"Written by":"Oliver Devane, Mohinder Gill","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-exploit-kit-update-offers-security-tips\/#article","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-exploit-kit-update-offers-security-tips\/"},"author":{"name":"Oliver Devane","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/f3e79f95122a1e56c0b07811a4f2188a"},"headline":"Trillium Exploit Kit Update Offers &#8216;Security Tips&#8217;","datePublished":"2016-06-02T23:27:08+00:00","dateModified":"2025-06-06T09:14:38+00:00","mainEntityOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-exploit-kit-update-offers-security-tips\/"},"wordCount":517,"publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-exploit-kit-update-offers-security-tips\/#primaryimage"},"thumbnailUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/od_2305_004.jpg","keywords":["cybercrime","email and web security","internet security","malware"],"articleSection":["McAfee Labs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-exploit-kit-update-offers-security-tips\/","url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-exploit-kit-update-offers-security-tips\/","name":"Trillium Exploit Kit Update Offers 'Security Tips' | McAfee Blog","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-exploit-kit-update-offers-security-tips\/#primaryimage"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-exploit-kit-update-offers-security-tips\/#primaryimage"},"thumbnailUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/od_2305_004.jpg","datePublished":"2016-06-02T23:27:08+00:00","dateModified":"2025-06-06T09:14:38+00:00","description":"McAfee Labs has previously blogged about the\u00a0Trillium Exploit Kit Version 3.0, which is commonly used to create and distribute malware. Last week, Version","breadcrumb":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-exploit-kit-update-offers-security-tips\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-exploit-kit-update-offers-security-tips\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-exploit-kit-update-offers-security-tips\/#primaryimage","url":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/od_2305_004.jpg","contentUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/od_2305_004.jpg"},{"@type":"BreadcrumbList","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/trillium-exploit-kit-update-offers-security-tips\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https:\/\/www.mcafee.com\/blogs\/"},{"@type":"ListItem","position":2,"name":"Other Blogs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/"},{"@type":"ListItem","position":3,"name":"McAfee Labs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/"},{"@type":"ListItem","position":4,"name":"Trillium Exploit Kit Update Offers &#8216;Security Tips&#8217;"}]},{"@type":"WebSite","@id":"https:\/\/www.mcafee.com\/blogs\/#website","url":"https:\/\/www.mcafee.com\/blogs\/","name":"McAfee Blog","description":"Internet Security News","publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.mcafee.com\/blogs\/#organization","name":"McAfee","url":"https:\/\/www.mcafee.com\/blogs\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","width":1286,"height":336,"caption":"McAfee"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.youtube.com\/McAfee"]},{"@type":"Person","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/f3e79f95122a1e56c0b07811a4f2188a","name":"Oliver Devane","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/145287b0eca301fc80d99baf060dd274","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/Oliver-Devane-96x96.jpg","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/Oliver-Devane-96x96.jpg","caption":"Oliver Devane"},"description":"Oliver Devane is currently a Senior Security Researcher at McAfee. He is based in the UK office and has over 10 years of experience analyzing Malware and Potentially Unwanted Programs.","sameAs":["https:\/\/www.linkedin.com\/in\/oliver-devane-1a528749\/"],"url":"https:\/\/www.mcafee.com\/blogs\/author\/oliver-devane\/"}]}},"_links":{"self":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/50100","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/users\/774"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/comments?post=50100"}],"version-history":[{"count":2,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/50100\/revisions"}],"predecessor-version":[{"id":215199,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/50100\/revisions\/215199"}],"wp:attachment":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media?parent=50100"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/categories?post=50100"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/tags?post=50100"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/coauthors?post=50100"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}