На маркетплейсі Microsoft для Visual Studio Code знайшли два шкідливі розширення, які заражають машини розробників стилерами. Малвар вміє робити скріншоти, красти паролі та криптогаманці, а також перехоплювати браузерні сесії.

The VS Code Malware That Captures Your Screen | Koi Blog
koi.ai/blog/the-vs-code-malwar…

#malware #infostealers #windows #vscode #vscode_extention

🏔️ 🥾

𝗘𝗦𝗖𝗨𝗥𝗦𝗜𝗢𝗡𝗘 𝗚𝗥𝗔𝗧𝗨𝗜𝗧𝗔 𝗱𝗶 𝗡𝗔𝗧𝗔𝗟𝗘 🎁 🎄 ＋ 𝗖𝗲𝗻𝗮 𝗱𝗶 𝗚𝗿𝘂𝗽𝗽𝗼 - 𝗦𝗔𝗕𝗔𝗧𝗢 𝟮𝟬 𝗗𝗜𝗖𝗘𝗠𝗕𝗥𝗘 𝟮𝟬𝟮𝟱

𝗧𝗿𝗲𝗸𝗸𝗶𝗻𝗴 𝗻𝗲𝗹𝗹𝗮 𝗥𝗶𝘀𝗲𝗿𝘃𝗮 𝗱𝗶 𝗠𝗼𝗻𝘁𝗲 𝗖𝗮𝘁𝗶𝗹𝗹𝗼 － "𝗢𝗿𝗶𝘇𝘇𝗼𝗻𝘁𝗶 𝗧𝗶𝗯𝘂𝗿𝘁𝗶𝗻𝗶"

Un'esperienza nei pressi di #Tivoli, a due passi da #Roma.

Facile #escursione seguita da una #cena di gruppo per festeggiare insieme la fine della stagione escursionistica!

𝗜𝗡𝗙𝗢 𝗘 𝗣𝗥𝗘𝗡𝗢𝗧𝗔𝗭𝗜𝗢𝗡𝗘 𝗢𝗕𝗕𝗟𝗜𝗚𝗔𝗧𝗢𝗥𝗜𝗔
greentrek.it/escursioni/escurs…

#trekking #escursioni #escursionismo #storia #natura #camminare #Lazio #gratis #foto #fotografia #hiking #outdoor

Frogblight threatens you with a court case: a new Android banker targets Turkish users

In August 2025, we discovered a campaign targeting individuals in Turkey with a new Android banking Trojan we dubbed “Frogblight”. Initially, the malware was disguised as an app for accessing court case files via an official government webpage. Later, more universal disguises appeared, such as the Chrome browser.

Frogblight can use official government websites as an intermediary step to steal banking credentials. Moreover, it has spyware functionality, such as capabilities to collect SMS messages, a list of installed apps on the device and device filesystem information. It can also send arbitrary SMS messages.

Another interesting characteristic of Frogblight is that we’ve seen it updated with new features throughout September. This may indicate that a feature-rich malware app for Android is being developed, which might be distributed under the MaaS model.

This threat is detected by Kaspersky products as HEUR:Trojan-Banker.AndroidOS.Frogblight.*, HEUR:Trojan-Banker.AndroidOS.Agent.eq, HEUR:Trojan-Banker.AndroidOS.Agent.ep, HEUR:Trojan-Spy.AndroidOS.SmsThief.de.

Technical details

Background

While performing an analysis of mobile malware we receive from various sources, we discovered several samples belonging to a new malware family. Although these samples appeared to be still under development, they already contained a lot of functionality that allowed this family to be classified as a banking Trojan. As new versions of this malware continued to appear, we began monitoring its development. Moreover, we managed to discover its control panel and based on the “fr0g” name shown there, we dubbed this family “Frogblight”.

Initial infection

We believe that smishing is one of the distribution vectors for Frogblight, and that the users had to install the malware themselves. On the internet, we found complaints from Turkish users about phishing SMS messages convincing users that they were involved in a court case and containing links to download malware. versions of Frogblight, including the very first ones, were disguised as an app for accessing court case files via an official government webpage and were named the same as the files for downloading from the links mentioned above.

While looking for online mentions of the names used by the malware, we discovered one of the phishing websites distributing Frogblight, which disguises itself as a website for viewing a court file.

The phishing website distributing Frogblight

We were able to open the admin panel of this website, where it was possible to view statistics on Frogblight malware downloads. However, the counter had not been fully implemented and the threat actor could only view the statistics for their own downloads.

The admin panel interface of the website from which Frogblight is downloaded

Additionally, we found the source code of this phishing website available in a public GitHub repository. Judging by its description, it is adapted for fast deployment to Vercel, a platform for hosting web apps.

The GitHub repository with the phishing website source code

App features

As already mentioned, Frogblight was initially disguised as an app for accessing court case files via an official government webpage. Let’s look at one of the samples using this disguise (9dac23203c12abd60d03e3d26d372253). For analysis, we selected an early sample, but not the first one discovered, in order to demonstrate more complete Frogblight functionality.

After starting, the app prompts the victim to grant permissions to send and read SMS messages, and to read from and write to the device’s storage, allegedly needed to show a court file related to the user.

The full list of declared permissions in the app manifest file is shown below:

• MANAGE_EXTERNAL_STORAGE
• READ_EXTERNAL_STORAGE
• WRITE_EXTERNAL_STORAGE
• READ_SMS
• RECEIVE_SMS
• SEND_SMS
• WRITE_SMS
• RECEIVE_BOOT_COMPLETED
• INTERNET
• QUERY_ALL_PACKAGES
• BIND_ACCESSIBILITY_SERVICE
• DISABLE_KEYGUARD
• FOREGROUND_SERVICE
• FOREGROUND_SERVICE_DATA_SYNC
• POST_NOTIFICATIONS
• QUICKBOOT_POWERON
• RECEIVE_MMS
• RECEIVE_WAP_PUSH
• REQUEST_IGNORE_BATTERY_OPTIMIZATIONS
• SCHEDULE_EXACT_ALARM
• USE_EXACT_ALARM
• VIBRATE
• WAKE_LOCK
• ACCESS_NETWORK_STATE
• READ_PHONE_STATE

After all required permissions are granted, the malware opens the official government webpage for accessing court case files in WebView, prompting the victim to sign in. There are different sign-in options, one of them via online banking. If the user chooses this method, they are prompted to click on a bank whose online banking app they use and fill out the sign-in form on the bank’s official website. This is what Frogblight is after, so it waits two seconds, then opens the online banking sign-in method regardless of the user’s choice. For each webpage that has finished loading in WebView, Frogblight injects JavaScript code allowing it to capture user input and send it to the C2 via a REST API.

The malware also changes its label to “Davalarım” if the Android version is newer than 12; otherwise it hides the icon.

The app icon before (left) and after launching (right)
In the sample we review in this section, Frogblight uses a REST API for C2 communication, implemented using the Retrofit library. The malicious app pings the C2 server every two seconds in foreground, and if no error is returned, it calls the REST API client methods fetchOutbox and getFileCommands. Other methods are called when specific events occur, for example, after the device screen is turned on, the com.capcuttup.refresh.PersistentService foreground service is launched, or an SMS is received. The full list of all REST API client methods with parameters and descriptions is shown below.

Remote device control, persistence, and protection against deletion

The app includes several classes to provide the threat actor with remote access to the infected device, gain persistence, and protect the malicious app from being deleted.

• capcuttup.refresh.AccessibilityAutoClickService
  This is intended to prevent removal of the app and to open websites specified by the threat actor in WebView upon target apps startup. It is present in the sample we review, but is no longer in use and deleted in further versions.
• capcuttup.refresh.PersistentService
  This is a service whose main purpose is to interact with the C2 and to make malicious tasks persistent.
• capcuttup.refresh.BootReceiver
  This is a broadcast receiver responsible for setting up the persistence mechanisms, such as job scheduling and setting alarms, after device boot completion.

Further development

In later versions, new functionality was added, and some of the more recent Frogblight variants disguised themselves as the Chrome browser. Let’s look at one of the fake Chrome samples (d7d15e02a9cd94c8ab00c043aef55aff).

In this sample, new REST API client methods have been added for interacting with the C2.

Also, the threat actor had implemented a custom input method for recording keystrokes to a file using the com.puzzlesnap.quickgame.CustomKeyboardService service.

Another Frogblight sample we observed trying to avoid emulators and using geofencing techniques is 115fbdc312edd4696d6330a62c181f35. In this sample, Frogblight checks the environment (for example, device model) and shuts down if it detects an emulator or if the device is located in the United States.

Part of the code responsible for avoiding Frogblight running in an undesirable environment

Later on, the threat actor decided to start using a web socket instead of the REST API. Let’s see an example of this in one of the recent samples (08a3b1fb2d1abbdbdd60feb8411a12c7). This sample is disguised as an app for receiving social support via an official government webpage. The feature set of this sample is very similar to the previous ones, with several new capabilities added. Commands are transmitted over a web socket using the JSON format. A command template is shown below:
{
"id": <command ID>,
"command_type": <command name>
"command_data": <command data>
}
It is also worth noting that some commands in this version share the same meaning but have different structures, and the functionality of certain commands has not been fully implemented yet. This indicates that Frogblight was under active development at the time of our research, and since no its activity was noticed after September, it is possible that the malware is being finalized to a fully operational state before continuing to infect users’ devices. A full list of commands with their parameters and description is shown below: