MSN Password Stealing Trojan Becomes Public


Ah another trojan, this time targeting MSN Live logins for. The trojan has been made public by some kind citizen calling himself “Our Godfather” on the BitTorrent network.

The sad thing is…I guess it works and hundreds of people will have installed it.

Malware designed to steal users’ Windows Live Messenger password has been released onto the net. The password stealer was released for download via BitTorrent earlier this week by a hacker using the handle “Our Godfather”.

The malware comes in the form of an IMB download confirmed by anti-virus firm Sophos as containing a password-stealing Trojan horse. Victims would need to be tricked into downloading and executing the malware, which might be renamed in a bid to disguise its identity, in order for the exploit to work.

It works a bit like the common phishing schemes, but it uses actual software to emulate the MSN Messenger login screen rather than a web-page.

“It displays a fake Windows Live Messenger Login Screen and prompts for login details. Username and password are captured and stored in C:\pas.txt,” explained Sophos senior technology consultant Graham Cluley.

Sophos has named the malware as MSNfake-M and added protection against the code to its security software packages. Other anti-virus firms can be expected to follow suit.

Another reason to use Sophos I guess, they are always ahead of the curve on this stuff.

Source: The Register

Posted in: Malware, Windows Hacking

, , , , ,


Latest Posts:


GitLab Watchman - Audit Gitlab For Sensitive Data & Credentials GitLab Watchman – Audit Gitlab For Sensitive Data & Credentials
GitLab Watchman is an app that uses the GitLab API to audit GitLab for sensitive data and credentials exposed internally, this includes code, commits, wikis etc
GKE Auditor - Detect Google Kubernetes Engine Misconfigurations GKE Auditor – Detect Google Kubernetes Engine Misconfigurations
GKE Auditor is a Java-based tool to detect Google Kubernetes Engine misconfigurations, it aims to help security & dev teams streamline the configuration process
zANTI - Android Wireless Hacking Tool Free Download zANTI – Android Wireless Hacking Tool Free Download
zANTI is an Android Wireless Hacking Tool that functions as a mobile penetration testing toolkit that lets you assess the risk level of a network using mobile.
HELK - Open Source Threat Hunting Platform HELK – Open Source Threat Hunting Platform
The Hunting ELK or simply the HELK is an Open-Source Threat Hunting Platform with advanced analytics capabilities such as SQL declarative language, graphing etc
trape - OSINT Analysis Tool For People Tracking Trape – OSINT Analysis Tool For People Tracking
Trape is an OSINT analysis tool, which allows people to track and execute intelligent social engineering attacks in real-time.
Fuzzilli - JavaScript Engine Fuzzing Library Fuzzilli – JavaScript Engine Fuzzing Library
Fuzzilii is a JavaScript engine fuzzing library, it's a coverage-guided fuzzer for dynamic language interpreters based on a custom intermediate language.


6 Responses to MSN Password Stealing Trojan Becomes Public

  1. asdas March 19, 2007 at 2:03 pm #

    Hello friends, I have released Msn Live Password Stealer V6, it has been modified so it will not be detected as a virus, so big mean companies like sophos will not detect it as a virus,

    This program is only said to be a virus because it can be used to retrieve a victims password, this program was intentionally made to be used for concerned parents who would like to monitor there kids for morally undesirable internet use so that the parents can, for example save conversation information so they can filter for words such as “drugs”, “alcohol” etc….

    The torrent keeps getting deleted when put on the torrent sites like torrentspy, and the popularity of this program has diminished due to this, this program can be downloaded through torrents sites like isohunt.

  2. Sypherknife June 5, 2007 at 12:31 pm #

    Why would you want to steal thousands of email accounts?
    Sure its fun to do it to a friend or.. someone you don’t like much.
    But why crate a trojan to steal passwords off people you don’t know :/

  3. Torvaun June 5, 2007 at 3:06 pm #

    Because of what goes through email accounts. Names and passwords to any forum or site you sign up for. Shipping information for anything you buy online. Just watching an email account can give you all the information you need to start stealing identities, which is always big business.

  4. Sandeep Nain September 4, 2007 at 11:46 pm #

    @asdas: I don’t think there is a point in stealing passwords for such small thing… Parents can always install s/w like keylogger and get better results.they can not only check the chat logs through that but also may know what kind of websites kids are visiting..
    I will term your software as trojan too…

  5. Alfred Farrington December 1, 2008 at 8:58 pm #

    Ah here we go again the issue of is this a tool or is it something just bad. I think it depends on the way you look at it to young kids its a way to spy on friends. To parents its a way to spy on children. To enterprises its a trojan. To anti-virus companies its bad news and you need to get rid of it. To the law its considered a way to steal identities. I think that people should stop just pressing yes to download something take the time to read before downloading something. I think alot of these things wouldn’t affect us if we took the time to pay attention.

  6. suniversi February 6, 2009 at 6:46 pm #

    saakls aa m