(Image credit: NicoElNino / Shutterstock) All of this stolen data can then be used to commit fraud or even identity theft.īesides stealing data from Google Chrome, Brave, Opera and Microsoft Edge, PY#RATION can also steal info from the best cryptocurrency wallets as well as user and system data from an infected PC. The latest version of PY#RATION (1.6.0) contains a number of features to make it easier for hackers to steal data from infected PCs.įor instance, the malware can transfer files to and from a C&C server, record keystrokes, detect if an infected machine is running antivirus software, steal clipboard data and extract both passwords and cookies from web browsers. Fortunately, you can also uninstall Cortana if you think Microsoft’s virtual assistant is too invasive. However, in the latest version of Windows, Cortana is no longer pinned to the taskbar. This makes the malware harder to detect as infected users might think it’s a legitimate Windows system file instead of a virus hiding in plain sight.Īlthough Microsoft’s virtual assistant isn’t nearly as popular as it once was, it’s still included in both Windows 10 and Windows 11. PY#RATION is able to establish persistence or a foothold on an infected Windows PC by adding a batch file called “CortanaAssist.bat” in a user’s startup directory. Other executable files are then downloaded, unpacked and run from this location.
However, the malware also creates “Cortana” and “Cortana/Setup” directories in a victim’s temporary folder.
0 kommentar(er)
