Peaklight Malware Targets Users to Steal Credentials, Browser History, and Financial Data

Peaklight malware, a sophisticated information stealer, has emerged as a significant threat to users worldwide.

This malware is primarily distributed through underground channels and is sometimes offered as a Malware-as-a-Service (MaaS), making it highly adaptable and potent.

Its primary goal is to exfiltrate sensitive information, including login credentials, browser history, financial data, and cryptocurrency wallet keys.

Once installed on a victim’s device, it maintains persistent access while evading common security checks.

Detection and Behavior

Peaklight malware exhibits several behaviors that can be detected using advanced security tools.

It typically begins by executing a PowerShell script that bypasses PowerShell’s security features and prevents loading user profiles.

The script drops a file in the temporary directory with an obfuscated name, and the malware allocates memory blocks for code execution.

It also checks network adapter addresses and queries system memory to detect potential sandbox environments.

These actions are indicative of its ability to evade detection and persist on compromised systems.

Organizations can detect Peaklight malware activities by leveraging tools like Sysmon and Wazuh.

Sysmon provides detailed insights into system activities such as process creation, network connections, and file modifications.

Wazuh, an open-source security platform, can be configured with specific detection rules to identify Peaklight’s malicious behavior.

For instance, Wazuh rules can be set to detect rogue files dropped in the temp directory, suspicious registry modifications, and process injection techniques used by the malware.

Mitigation and Removal

To proactively defend against Peaklight malware, organizations can integrate Wazuh with threat intelligence platforms like YARA.

This integration allows for real-time monitoring of file modifications and additions, enabling early detection of malicious files.

Once detected, the Wazuh Active Response module can remove these files before they pose a significant threat.

This approach enhances overall security by neutralizing threats at an early stage.

By monitoring directories like the Downloads folder and using YARA rules tailored to detect Peaklight indicators, organizations can effectively mitigate the risk posed by this malware.

Also Read:

FBI Warns of Data Extortion Scam Targeting Corporate Executives

See more