{"id":51314,"date":"2016-07-21T16:55:36","date_gmt":"2016-07-21T23:55:36","guid":{"rendered":"https:\/\/blogs.mcafee.com\/?p=51314"},"modified":"2025-06-03T21:41:41","modified_gmt":"2025-06-04T04:41:41","slug":"phishing-attacks-employ-old-effective-password-stealer","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/phishing-attacks-employ-old-effective-password-stealer\/","title":{"rendered":"Phishing Attacks Employ Old but Effective Password Stealer"},"content":{"rendered":"<p>A few months ago we received a sample from a customer that\u00a0turned out to be a password stealer (PWS). One thing about this malware stood out: the subdirectory used in the\u00a0access panel URL. It contained the string &#8220;***=**U=TEAM&#8221; (which we have obfuscated). Our investigations lead us to believe this may be a case of industrial espionage.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-51315\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/od001team_090316.jpg\" alt=\"_od001team_090316\" width=\"584\" height=\"67\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od001team_090316.jpg 584w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od001team_090316-300x34.jpg 300w\" sizes=\"auto, (max-width: 584px) 100vw, 584px\" \/><\/p>\n<p>The actors use compromised websites to host their access panels. Luckily for us they made a mistake and left the ZIP file they dropped on the compromised site.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-51316\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/od003team_090316.jpg\" alt=\"_od003team_090316\" width=\"384\" height=\"126\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od003team_090316.jpg 384w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od003team_090316-300x98.jpg 300w\" sizes=\"auto, (max-width: 384px) 100vw, 384px\" \/><\/p>\n<p>This enabled us to see how the back-end of the panel works. The Zip file contains\u00a0five\u00a0files:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-51317\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/od004team_090316.jpg\" alt=\"od004team_090316\" width=\"227\" height=\"69\" \/><\/p>\n<p>The three files of interest are config.php, index.php, and install.php.<\/p>\n<p>Config.php contains the password for the MySQL server they will set up.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-51318\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/od005team_090316.jpg\" alt=\"od005team_090316\" width=\"462\" height=\"244\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od005team_090316.jpg 462w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od005team_090316-300x158.jpg 300w\" sizes=\"auto, (max-width: 462px) 100vw, 462px\" \/><\/p>\n<p>Install.php creates the database\u00a0and sets up the panel to store the passwords stolen by the malware. We found the following snippet in the code:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-51319\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/od006team_090316.jpg\" alt=\"od006team_090316\" width=\"855\" height=\"100\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od006team_090316.jpg 855w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od006team_090316-300x35.jpg 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od006team_090316-768x90.jpg 768w\" sizes=\"auto, (max-width: 855px) 100vw, 855px\" \/><\/p>\n<p>We did some searching and found that &#8220;Bilal Ghouri&#8221; was originally responsible for the PHP back-end of the\u00a0popular PWS Hackhound Stealer, which was released in 2009.<\/p>\n<p>We also found this warning at the end of the code:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-51320\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/od007team_090316.jpg\" alt=\"od007team_090316\" width=\"977\" height=\"90\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od007team_090316.jpg 977w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od007team_090316-300x28.jpg 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od007team_090316-768x71.jpg 768w\" sizes=\"auto, (max-width: 977px) 100vw, 977px\" \/><\/p>\n<p>Surely they would have remembered to\u00a0delete this file!<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-51338\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/od008team_090316-1.jpg\" alt=\"_od008team_090316\" width=\"808\" height=\"294\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od008team_090316-1.jpg 808w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od008team_090316-1-300x109.jpg 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od008team_090316-1-768x279.jpg 768w\" sizes=\"auto, (max-width: 808px) 100vw, 808px\" \/><\/p>\n<p>The most important file is index.php. This file is responsible for storing the passwords uploaded by the malware and also enables the actors to search and export the data.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-51322\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/od009team_090316.jpg\" alt=\"od009team_090316\" width=\"578\" height=\"272\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od009team_090316.jpg 578w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od009team_090316-300x141.jpg 300w\" sizes=\"auto, (max-width: 578px) 100vw, 578px\" \/><\/p>\n<p>It is interesting that the script checks for a specific user agent, &#8220;HardCore Software For : Public.&#8221;<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-51323\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/od010team_090316.jpg\" alt=\"od010team_090316\" width=\"835\" height=\"99\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od010team_090316.jpg 835w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od010team_090316-300x36.jpg 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od010team_090316-768x91.jpg 768w\" sizes=\"auto, (max-width: 835px) 100vw, 835px\" \/><\/p>\n<p>This user agent is used by the malware when uploading the stolen data. The PHP script checks if the user agent matches the hardcoded one before allowing any data to be uploaded.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-51382\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/od014team_090316-1.jpg\" alt=\"_od014team_090316\" width=\"889\" height=\"70\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od014team_090316-1.jpg 889w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od014team_090316-1-300x24.jpg 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od014team_090316-1-768x60.jpg 768w\" sizes=\"auto, (max-width: 889px) 100vw, 889px\" \/><\/p>\n<p>The malware in use is ISR Stealer, a modified version of Hackhound Stealer. Our findings are confirmed by the comments in the preceding PHP code.<\/p>\n<h2>The PWS targets the following applications:<\/h2>\n<ul>\n<li>Internet Explorer<\/li>\n<li>Firefox<\/li>\n<li>Chrome<\/li>\n<li>Opera<\/li>\n<li>Safari<\/li>\n<li>Yahoo Messenger<\/li>\n<li>MSN Messenger<\/li>\n<li>Pidgin<\/li>\n<li>FileZilla<\/li>\n<li>Internet Download Manager<\/li>\n<li>JDownloader<\/li>\n<li>Trillian<\/li>\n<\/ul>\n<p>The following screen of the original Hackhound Stealer shows options for\u00a0building the malware:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-51325\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/od015team_090316.jpg\" alt=\"od015team_090316\" width=\"388\" height=\"565\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od015team_090316.jpg 388w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od015team_090316-206x300.jpg 206w\" sizes=\"auto, (max-width: 388px) 100vw, 388px\" \/><\/p>\n<p>This screen of the ISR Stealer builder was used by the actors behind the campaign.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-51326\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/od017team_090319.jpg\" alt=\"od017team_090319\" width=\"248\" height=\"182\" \/><\/p>\n<p>ISR Stealer uses two executables to gather passwords stored on the machine: Mail PassView and WebBrowserPassView, both by Nirsoft. These apps gather passwords stored in mail clients and web browsers. Both of these files reside in the resources of the ISR Stealer. The panel location is also stored in the malware&#8217;s resources, in a simple encrypted form with SUB 0x02.<\/p>\n<figure id=\"attachment_51327\" aria-describedby=\"caption-attachment-51327\" style=\"width: 740px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-51327 size-full\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/od020team_090320.jpg\" alt=\"od020team_090320\" width=\"740\" height=\"122\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od020team_090320.jpg 740w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od020team_090320-300x49.jpg 300w\" sizes=\"auto, (max-width: 740px) 100vw, 740px\" \/><figcaption id=\"caption-attachment-51327\" class=\"wp-caption-text\"><em>An encrypted URL.<\/em><\/figcaption><\/figure>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-51328 size-full\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/od021team_090320.jpg\" alt=\"od021team_090320\" width=\"740\" height=\"105\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od021team_090320.jpg 740w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od021team_090320-300x43.jpg 300w\" sizes=\"auto, (max-width: 740px) 100vw, 740px\" \/><\/p>\n<p><em>A decrypted URL.<\/em><\/p>\n<p>We did some more digging and found that the actors responsible for this malware have been active since the beginning of 2016, with the first sample spotted in the wild in January.<\/p>\n<p>The following spear-phishing emails were sent to entice targets to download and execute the PWS:<\/p>\n<p><strong>\u00a0<img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-51330\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/od013team_090316.jpg\" alt=\"od013team_090316\" width=\"685\" height=\"426\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od013team_090316.jpg 685w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od013team_090316-300x187.jpg 300w\" sizes=\"auto, (max-width: 685px) 100vw, 685px\" \/> <\/strong><\/p>\n<p><strong><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-51331\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/od011team_090316.jpg\" alt=\"od011team_090316\" width=\"866\" height=\"945\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od011team_090316.jpg 866w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od011team_090316-275x300.jpg 275w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od011team_090316-768x838.jpg 768w\" sizes=\"auto, (max-width: 866px) 100vw, 866px\" \/> <\/strong><\/p>\n<p>The actors have been busy\u00a0for several weeks, although we saw no activity during the Easter holiday. After &#8220;Easter break,&#8221; we noticed that they had slightly changed the panel. It now includes the string &#8220;Powered By NEW LINE OF *** **U TEAMS VERSION 2.1.&#8221;<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-51378\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/od016team_090316-1.jpg\" alt=\"_od016team_090316\" width=\"946\" height=\"425\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od016team_090316-1.jpg 946w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od016team_090316-1-300x135.jpg 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od016team_090316-1-768x345.jpg 768w\" sizes=\"auto, (max-width: 946px) 100vw, 946px\" \/><\/p>\n<p>One compromised website had more than 10\u00a0access panels receiving stolen passwords from the PWS.\u00a0We observed that some of the targets of the spear phishing are companies that\u00a0deal with machinery parts. The actors used some of the following filenames:<\/p>\n<ul>\n<li>(RFQ__1045667machine-oil valves).exe<\/li>\n<li>ButterflyCheckVALVES.exe<\/li>\n<li>BALL VALVE BIDDING.exe<\/li>\n<li>RFQ BALL VALVE.exe<\/li>\n<li>Ball Valves with BSPP conection.exe<\/li>\n<\/ul>\n<p>These names lead us to believe that industrial espionage might be a motive of the actors.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-51334\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/od018team_090320.jpg\" alt=\"od018team_090320\" width=\"764\" height=\"750\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od018team_090320.jpg 764w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od018team_090320-300x295.jpg 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od018team_090320-32x32.jpg 32w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od018team_090320-64x64.jpg 64w\" sizes=\"auto, (max-width: 764px) 100vw, 764px\" \/><\/p>\n<p>We have also noticed that they are attaching the malware with\u00a0a &#8220;.z&#8221; extension. This is likely because some popular ZIP file handlers will associate this file extension with their programs and allow users to extract it. Using .z also bypasses some popular cloud email file restrictions.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-51335\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/od019team_090320.jpg\" alt=\"od019team_090320\" width=\"513\" height=\"448\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od019team_090320.jpg 513w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od019team_090320-300x262.jpg 300w\" sizes=\"auto, (max-width: 513px) 100vw, 513px\" \/><\/p>\n<p>We contacted the website owners used by the actors and informed them of\u00a0the compromise so that they could\u00a0remove the panels.<\/p>\n<h2><strong>Prevention<\/strong><\/h2>\n<p>McAfee detects this threat as PWS-FCGH. We advise you block .z file extensions at the gateway level. This step will prevent other malware from using this technique in their phishing campaigns.<\/p>\n<p><strong>\u00a0<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"<p>A few months ago we received a sample from a customer that\u00a0turned out to be a password stealer (PWS). One&#8230;<\/p>\n","protected":false},"author":774,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[442],"tags":[76,4452,3923,338,180],"coauthors":[849,854],"class_list":["post-51314","post","type-post","status-publish","format-standard","hentry","category-mcafee-labs","tag-cybercrime","tag-cybersecurity","tag-email-and-web-security","tag-endpoint-protection","tag-malware"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v25.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Phishing Attacks Employ Old but Effective Password Stealer | McAfee Blog<\/title>\n<meta name=\"description\" content=\"A few months ago we received a sample from a customer that\u00a0turned out to be a password stealer (PWS). One thing about this malware stood out: the\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Phishing Attacks Employ Old but Effective Password Stealer | McAfee Blog\" \/>\n<meta property=\"og:description\" content=\"A few months ago we received a sample from a customer that\u00a0turned out to be a password stealer (PWS). One thing about this malware stood out: the\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/phishing-attacks-employ-old-effective-password-stealer\/\" \/>\n<meta property=\"og:site_name\" content=\"McAfee Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:published_time\" content=\"2016-07-21T23:55:36+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-06-04T04:41:41+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od001team_090316.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"584\" \/>\n\t<meta property=\"og:image:height\" content=\"67\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Oliver Devane, Mohinder Gill\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@McAfee\" \/>\n<meta name=\"twitter:site\" content=\"@McAfee\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Oliver Devane, Mohinder Gill\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/phishing-attacks-employ-old-effective-password-stealer\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/phishing-attacks-employ-old-effective-password-stealer\/\"},\"author\":{\"name\":\"Oliver Devane\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/f3e79f95122a1e56c0b07811a4f2188a\"},\"headline\":\"Phishing Attacks Employ Old but Effective Password Stealer\",\"datePublished\":\"2016-07-21T23:55:36+00:00\",\"dateModified\":\"2025-06-04T04:41:41+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/phishing-attacks-employ-old-effective-password-stealer\/\"},\"wordCount\":705,\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/phishing-attacks-employ-old-effective-password-stealer\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/od001team_090316.jpg\",\"keywords\":[\"cybercrime\",\"cybersecurity\",\"email and web security\",\"endpoint protection\",\"malware\"],\"articleSection\":[\"McAfee Labs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/phishing-attacks-employ-old-effective-password-stealer\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/phishing-attacks-employ-old-effective-password-stealer\/\",\"name\":\"Phishing Attacks Employ Old but Effective Password Stealer | McAfee Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/phishing-attacks-employ-old-effective-password-stealer\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/phishing-attacks-employ-old-effective-password-stealer\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/od001team_090316.jpg\",\"datePublished\":\"2016-07-21T23:55:36+00:00\",\"dateModified\":\"2025-06-04T04:41:41+00:00\",\"description\":\"A few months ago we received a sample from a customer that\u00a0turned out to be a password stealer (PWS). One thing about this malware stood out: the\",\"breadcrumb\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/phishing-attacks-employ-old-effective-password-stealer\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/phishing-attacks-employ-old-effective-password-stealer\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/phishing-attacks-employ-old-effective-password-stealer\/#primaryimage\",\"url\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/od001team_090316.jpg\",\"contentUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/od001team_090316.jpg\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/phishing-attacks-employ-old-effective-password-stealer\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Other Blogs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"McAfee Labs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Phishing Attacks Employ Old but Effective Password Stealer\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"name\":\"McAfee Blog\",\"description\":\"Internet Security News\",\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\",\"name\":\"McAfee\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"width\":1286,\"height\":336,\"caption\":\"McAfee\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.youtube.com\/McAfee\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/f3e79f95122a1e56c0b07811a4f2188a\",\"name\":\"Oliver Devane\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/145287b0eca301fc80d99baf060dd274\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/Oliver-Devane-96x96.jpg\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/Oliver-Devane-96x96.jpg\",\"caption\":\"Oliver Devane\"},\"description\":\"Oliver Devane is currently a Senior Security Researcher at McAfee. He is based in the UK office and has over 10 years of experience analyzing Malware and Potentially Unwanted Programs.\",\"sameAs\":[\"https:\/\/www.linkedin.com\/in\/oliver-devane-1a528749\/\"],\"url\":\"https:\/\/www.mcafee.com\/blogs\/author\/oliver-devane\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Phishing Attacks Employ Old but Effective Password Stealer | McAfee Blog","description":"A few months ago we received a sample from a customer that\u00a0turned out to be a password stealer (PWS). One thing about this malware stood out: the","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"Phishing Attacks Employ Old but Effective Password Stealer | McAfee Blog","og_description":"A few months ago we received a sample from a customer that\u00a0turned out to be a password stealer (PWS). One thing about this malware stood out: the","og_url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/phishing-attacks-employ-old-effective-password-stealer\/","og_site_name":"McAfee Blog","article_publisher":"https:\/\/www.facebook.com\/McAfee\/","article_published_time":"2016-07-21T23:55:36+00:00","article_modified_time":"2025-06-04T04:41:41+00:00","og_image":[{"width":584,"height":67,"url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/od001team_090316.jpg","type":"image\/jpeg"}],"author":"Oliver Devane, Mohinder Gill","twitter_card":"summary_large_image","twitter_creator":"@McAfee","twitter_site":"@McAfee","twitter_misc":{"Written by":"Oliver Devane, Mohinder Gill","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/phishing-attacks-employ-old-effective-password-stealer\/#article","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/phishing-attacks-employ-old-effective-password-stealer\/"},"author":{"name":"Oliver Devane","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/f3e79f95122a1e56c0b07811a4f2188a"},"headline":"Phishing Attacks Employ Old but Effective Password Stealer","datePublished":"2016-07-21T23:55:36+00:00","dateModified":"2025-06-04T04:41:41+00:00","mainEntityOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/phishing-attacks-employ-old-effective-password-stealer\/"},"wordCount":705,"publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/phishing-attacks-employ-old-effective-password-stealer\/#primaryimage"},"thumbnailUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/od001team_090316.jpg","keywords":["cybercrime","cybersecurity","email and web security","endpoint protection","malware"],"articleSection":["McAfee Labs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/phishing-attacks-employ-old-effective-password-stealer\/","url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/phishing-attacks-employ-old-effective-password-stealer\/","name":"Phishing Attacks Employ Old but Effective Password Stealer | McAfee Blog","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/phishing-attacks-employ-old-effective-password-stealer\/#primaryimage"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/phishing-attacks-employ-old-effective-password-stealer\/#primaryimage"},"thumbnailUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/od001team_090316.jpg","datePublished":"2016-07-21T23:55:36+00:00","dateModified":"2025-06-04T04:41:41+00:00","description":"A few months ago we received a sample from a customer that\u00a0turned out to be a password stealer (PWS). One thing about this malware stood out: the","breadcrumb":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/phishing-attacks-employ-old-effective-password-stealer\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/phishing-attacks-employ-old-effective-password-stealer\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/phishing-attacks-employ-old-effective-password-stealer\/#primaryimage","url":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/od001team_090316.jpg","contentUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/od001team_090316.jpg"},{"@type":"BreadcrumbList","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/phishing-attacks-employ-old-effective-password-stealer\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https:\/\/www.mcafee.com\/blogs\/"},{"@type":"ListItem","position":2,"name":"Other Blogs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/"},{"@type":"ListItem","position":3,"name":"McAfee Labs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/"},{"@type":"ListItem","position":4,"name":"Phishing Attacks Employ Old but Effective Password Stealer"}]},{"@type":"WebSite","@id":"https:\/\/www.mcafee.com\/blogs\/#website","url":"https:\/\/www.mcafee.com\/blogs\/","name":"McAfee Blog","description":"Internet Security News","publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.mcafee.com\/blogs\/#organization","name":"McAfee","url":"https:\/\/www.mcafee.com\/blogs\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","width":1286,"height":336,"caption":"McAfee"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.youtube.com\/McAfee"]},{"@type":"Person","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/f3e79f95122a1e56c0b07811a4f2188a","name":"Oliver Devane","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/145287b0eca301fc80d99baf060dd274","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/Oliver-Devane-96x96.jpg","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/Oliver-Devane-96x96.jpg","caption":"Oliver Devane"},"description":"Oliver Devane is currently a Senior Security Researcher at McAfee. He is based in the UK office and has over 10 years of experience analyzing Malware and Potentially Unwanted Programs.","sameAs":["https:\/\/www.linkedin.com\/in\/oliver-devane-1a528749\/"],"url":"https:\/\/www.mcafee.com\/blogs\/author\/oliver-devane\/"}]}},"_links":{"self":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/51314","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/users\/774"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/comments?post=51314"}],"version-history":[{"count":2,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/51314\/revisions"}],"predecessor-version":[{"id":215044,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/51314\/revisions\/215044"}],"wp:attachment":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media?parent=51314"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/categories?post=51314"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/tags?post=51314"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/coauthors?post=51314"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}